What is the CVSS score of CVE-2026-8089?

CVE-2026-8089 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-8089?

Yes, a public proof-of-concept exploit is available for CVE-2026-8089. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-8089?

Yes, a patch is available for CVE-2026-8089. Update the affected software to the latest version immediately.

Wemail CVE-2026-8089

EUVD-2026-37557 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 WPScan

XSS WordPress Wemail

7.1

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from CISA-ADP · only source for this CVE.

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 09:01 EUVD

CVE Published

Jun 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.

Analysis

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-8089 vulnerability details – vuln.today

Back