EUVD-2026-35377
GHSA-9jw9-xmq5-9839
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as author
-
DeliveryCreate campaign with malicious HTML in content field
-
ExploitAdmin previews campaign from dashboard
-
ExecutionStored XSS executes in admin's browser
-
ImpactAttacker steals session cookies or performs actions under admin identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with at least the 'Author' role. The attacker must have access to the admin dashboard campaign editor to inject the malicious HTML. The vulnerability only triggers when the campaign preview is viewed within the admin dashboard; the public-facing preview endpoint (/mp-email/{id}-slug/) is not exploitable because it enforces a Content-Security-Policy header that blocks inline scripts. No interaction from the victim beyond viewing the preview is needed, but the victim must be logged into WordPress admin. |
| Impact | CVSS 3.1 base score 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates a network-accessible, low-complexity attack requiring only low privileges (author-level), but the scope change reflects impact on other resources (admin session). However, the EPSS score of 0.06% and SSVC assessment of 'Exploitation: none, Automatable: no, Technical Impact: partial' suggest a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, and no public exploit code has been reported. The requirement for authenticated access and the restriction to the admin dashboard significantly limit real-world impact. Overall, this is a moderate-risk issue that should be patched but is not an immediate crisis. |
| Exploit ScenarioDerived | An attacker with an author-level account on a WordPress site creates a new campaign and inserts a malicious script (e.g., <script>alert('XSS')</script>) into the Campaign HTML Content field. When an administrator or another user views the campaign preview from the admin dashboard, the script executes in their browser. The attacker could then steal session cookies, perform actions under the admin's identity, or deface the admin interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Stored cross-site scripting in the MailerPress WordPress plugin (versions up to 2.0.4) allows authenticated attackers with author-level access or higher to inject arbitrary web scripts via the Campaign HTML Content field. Exploitation is limited to the admin dashboard preview, as the public-facing campaign preview endpoint enforces a Content-Security-Policy blocking inline scripts. No active exploitation or public exploit code has been identified, and the EPSS score is low (0.06%).
RemediationAI
Upgrade the MailerPress plugin to version 2.0.5 or later immediately. This version addresses the insufficient input sanitization and output escaping in the Campaign HTML Content field. No effective workaround exists within the plugin, but as exploitation requires an authenticated author account, administrators can reduce risk by limiting the number of author-level users and carefully vetting campaign content. If patching is delayed, consider disabling the plugin's campaign functionality or restricting access to the admin dashboard for untrusted authors. The vendor advisory can be found at the Wordfence link above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored cross-site scripting (CWE-79) within the WordPress plugin 'MailerPress - Email Marketing, Newsletter, Email Automation & WooCommerce Emails'. The plugin fails to sanitize and escape user-supplied HTML content in the Campaign HTML Content field, allowing authors to store malicious scripts. When an administrator or other user views the campaign preview in the admin dashboard, the stored script executes in their browser session. The CPE string cpe:2.3:a:mailerpress:mailerpress_-_email_marketing,_newsletter,_email_automation_&_woocommerce_emails:*:*:*:*:*:*:*:* identifies all versions as affected, with the fix applied in version 2.0.5.
Know when Mailerpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS matches description: network vector, low complexity, low privileges required, scope change to admin session.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The MailerPress - Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is not affected by this vulnerability, as it applies a Content-Security-Policy header blocking all inline scripts; exploitation is limited to the admin dashboard preview.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Mailerpress
View allPrivilege escalation in the MailerPress WordPress plugin (versions up to and including 2.0.2) lets an authenticated low-
MailerPress through version 1.4.2 contains a server-side request forgery (SSRF) vulnerability that allows authenticated
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress pl
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievab
Exploit-DB