What is the CVSS score of CVE-2026-8599?

CVE-2026-8599 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

MailerPress CVE-2026-8599

EUVD-2026-35377 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-9jw9-xmq5-9839

WordPress XSS Mailerpress Wordpress Plugin Mailerpress Email Marketing Newsletter Email Automation Woocommerce Emails

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

CVSS matches description: network vector, low complexity, low privileges required, scope change to admin session.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 09:17 vuln.today

CVE Published

Jun 09, 2026 - 07:49 nvd

MEDIUM 6.4

DescriptionCVE.org

The MailerPress - Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is not affected by this vulnerability, as it applies a Content-Security-Policy header blocking all inline scripts; exploitation is limited to the admin dashboard preview.

AnalysisAI

Stored cross-site scripting in the MailerPress WordPress plugin (versions up to 2.0.4) allows authenticated attackers with author-level access or higher to inject arbitrary web scripts via the Campaign HTML Content field. Exploitation is limited to the admin dashboard preview, as the public-facing campaign preview endpoint enforces a Content-Security-Policy blocking inline scripts. No active exploitation or public exploit code has been identified, and the EPSS score is low (0.06%).

Technical ContextAI

The vulnerability is a stored cross-site scripting (CWE-79) within the WordPress plugin 'MailerPress - Email Marketing, Newsletter, Email Automation & WooCommerce Emails'. The plugin fails to sanitize and escape user-supplied HTML content in the Campaign HTML Content field, allowing authors to store malicious scripts. When an administrator or other user views the campaign preview in the admin dashboard, the stored script executes in their browser session. The CPE string cpe:2.3:a:mailerpress:mailerpress_-_email_marketing,_newsletter,_email_automation_&_woocommerce_emails:*:*:*:*:*:*:*:* identifies all versions as affected, with the fix applied in version 2.0.5.

RemediationAI

Upgrade the MailerPress plugin to version 2.0.5 or later immediately. This version addresses the insufficient input sanitization and output escaping in the Campaign HTML Content field. No effective workaround exists within the plugin, but as exploitation requires an authenticated author account, administrators can reduce risk by limiting the number of author-level users and carefully vetting campaign content. If patching is delayed, consider disabling the plugin's campaign functionality or restricting access to the admin dashboard for untrusted authors. The vendor advisory can be found at the Wordfence link above.