SiteGround Email Marketing CVE-2026-57416

Exploitation requires the SiteGround Email Marketing plugin (≤ 1.7.5) to be installed and active on a WordPress site, and it depends on mandatory victim interaction (CVSS UI:R): the injected payload only executes when a user loads the page that renders the stored, unsanitized input, so an administrator or other user must view the affected content. The CVSS vector lists PR:N (no authentication to inject), but because this is a plugin-specific stored-XSS sink, the practical prerequisite is reaching whatever field or endpoint persists the payload - verify whether that path is truly unauthenticated or requires a low-privileged account. Limiting factors: attack surface is confined to sites running this specific plugin, the payload is inert until rendered, and impact is scoped to the browser/session context of whoever views it rather than direct server compromise.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates network reachability, low complexity, no privileges required, but mandatory user interaction and a scope change, with limited confidentiality/integrity/availability impact - consistent with a stored XSS whose payload fires only when a victim views the page. Signal cross-reference tempers the raw score: there is no EPSS value supplied, no POC referenced, and no KEV listing, so this is a real but not urgent priority relative to network-facing RCE or actively exploited bugs. The PR:N rating is worth scrutiny - many WordPress stored-XSS issues of this class require at least low-privileged authenticated input to reach the vulnerable sink, so 'no privileges required' should be verified against the actual injection path before treating it as fully pre-auth. Practical risk is dominated by the low deployment footprint of this specific plugin rather than by exploitation ease.

An attacker submits input containing a crafted script payload into a field handled by the plugin that is stored without proper sanitization. When a site administrator or other user later opens the page that renders that stored value, the JavaScript executes in their authenticated browser session, enabling session/cookie theft, forced administrative actions, or content manipulation. No public POC is referenced, and low attack complexity means a working payload would be straightforward to craft once the injection point is known.