What is the CVSS score of EUVD-2026-35377?

EUVD-2026-35377 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

MailerPress WordPress Plugin EUVD-2026-35377

| CVE-2026-8599 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-9jw9-xmq5-9839

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 09:17 vuln.today

CVE Published

Jun 09, 2026 - 07:49 nvd

MEDIUM 6.4

DescriptionCVE.org

The MailerPress - Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is not affected by this vulnerability, as it applies a Content-Security-Policy header blocking all inline scripts; exploitation is limited to the admin dashboard preview.

AnalysisAI

{id}-slug/) enforces a Content-Security-Policy header that blocks all inline scripts, meaning the attack surface is exclusively the WordPress admin dashboard preview context. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored XSS variant. The vulnerability originates in insufficient input sanitization when saving Campaign HTML Content and insufficient output escaping when rendering that content in the admin preview. WordPress Trac source references pinpoint the vulnerable logic to Campaigns.php lines 2100, 2128, and 2137 in the 2.0.3 tag, and CampaignEmail.php line 161 - the same lines are present in trunk prior to the fix. The affected CPE is cpe:2.3:a:mailerpress:mailerpress_-_email_marketing,_newsletter,_email_automation_&_woocommerce_emails:*:*:*:*:*:*:*:*. The CVSS vector's Changed Scope (S:C) reflects that the injected payload crosses from the plugin's storage context into a victim's browser context. Notably, the CVSS vector scores UI:N (no user interaction), which is consistent with stored XSS where the payload executes automatically upon an admin navigating to the campaign preview - no deliberate victim interaction beyond normal dashboard use is required beyond that navigation.

RemediationAI

Upgrade MailerPress to version 2.0.5 or later. The CVE scope language ('all versions up to, and including, 2.0.4') combined with WordPress Trac references showing updated code in the 2.0.5 tag (Campaigns.php at revised line numbers 4713 and 2229, indicating substantial code changes) strongly indicates 2.0.5 contains the fix; however, the exact fix version is inferred from CVE scope language and Trac source refs rather than an explicit vendor changelog - verify against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c52cadb2-703f-4aad-85f2-aec1dd4befdc?source=cve before deploying. As a compensating control prior to patching, restrict the Author role on affected WordPress sites to trusted users only, or temporarily revoke the ability to create or edit campaigns for non-admin roles via a capability management plugin - note this may disrupt intended editorial workflows. Web Application Firewall rules targeting stored XSS payloads in REST API campaign endpoints can reduce risk but are not a substitute for patching.