What is the CVSS score of CVE-2026-57416?

CVE-2026-57416 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of SiteGround Email Marketing are affected by CVE-2026-57416?

The SiteGround Email Marketing WordPress plugin (versions ≤1.7.5) contains a stored cross-site scripting vulnerability allowing attackers to inject persistent malicious code that executes for all…

How to fix or mitigate CVE-2026-57416?

Within 24 hours, identify all WordPress installations running SiteGround Email Marketing plugin version 1.7.5 or earlier and immediately disable and remove the plugin; perform an initial review of plugin-related data storage for obvious malicious scripts. Within 7 days, conduct a comprehensive security audit of all stored content for injected JavaScript, analyze admin and user access logs for suspicious activity, and implement temporary functional restrictions on remaining installations. Within 30 days, monitor SiteGround's security advisories for patch availability and redeploy using the patched version when released; if no patch is available after 60 days, migrate to an alternative email marketing WordPress plugin and implement WAF rules to block similar XSS patterns.

SiteGround Email Marketing CVE-2026-57416

EUVD-2026-43343 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Siteground Email Marketing Siteground

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS in a plugin sink typically needs a low-privileged authenticated user to inject (PR:L) and admin view (UI:R); scope change to browser context (S:C), limited C/I, no real availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:55 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

AnalysisAI

Stored cross-site scripting in the SiteGround Email Marketing WordPress plugin (versions up to and including 1.7.5) lets attackers persist malicious JavaScript that executes in the context of a victim's browser when the affected page is rendered. Reported by Patchstack with a CVSS 3.1 base score of 7.1 and a scope-changed impact, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because the injected payload is stored server-side, it can strike any user - including administrators - who later loads the tainted content.

Technical ContextAI

The affected component is the SiteGround Email Marketing plugin for WordPress (CPE cpe:2.3:a:siteground:siteground_email_marketing), an add-on that integrates email-campaign/subscriber functionality into WordPress sites. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: user-controllable input is written into generated HTML without adequate output encoding or sanitization, so an attacker-supplied string containing markup or script is interpreted by the browser rather than displayed as inert text. As a stored (persistent) XSS, the payload is saved in the site's data store (e.g., a plugin setting, form field, or subscriber record) and re-served on subsequent page loads, giving it broader and more durable reach than reflected XSS.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to a release later than 1.7.5 once SiteGround publishes one and confirm the fixed version against the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/siteground-email-marketing/vulnerability/wordpress-siteground-email-marketing-plugin-1-7-5-cross-site-scripting-xss-vulnerability. As interim compensating controls, deploy a web application firewall or Patchstack's virtual patching to filter script payloads targeting the plugin's inputs (trade-off: WAF rules can be bypassed by novel encodings and may cause false positives on legitimate rich content); restrict access to the plugin's administrative and settings pages to trusted, authenticated staff to limit who can inject or view stored content; and if the plugin's email-marketing features are not in active use, deactivate and remove it to eliminate the sink entirely (trade-off: loss of the plugin's subscriber/campaign functionality).