What is the CVSS score of EUVD-2026-37557?

EUVD-2026-37557 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of weMail are affected by EUVD-2026-37557?

The weMail WordPress plugin (versions before 2.1.3) contains a reflected cross-site scripting vulnerability with publicly available exploit code that allows attackers to inject malicious scripts and…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-37557?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37557. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-37557?

Within 24 hours, audit all WordPress installations to identify weMail plugin presence and current version. Within 7 days, upgrade weMail to version 2.1.3 or later across all affected sites-this patch fully addresses the vulnerability. Within 30 days, review authentication logs for suspicious login patterns and confirm no unauthorized administrative access occurred during the vulnerability window.

weMail EUVD-2026-37557

| CVE-2026-8089 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 WPScan

XSS WordPress Wemail

7.1

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network delivery (PR:N/AV:N) but victim must click a crafted link (UI:R); reflected XSS runs in a different security context (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from CISA-ADP.

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:21 vuln.today

Patch available

Jun 17, 2026 - 09:01 EUVD

CVE Published

Jun 17, 2026 - 06:00 cve.org

HIGH 7.1

CVE Published

Jun 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.

AnalysisAI

Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.

Technical ContextAI

weMail is an email-marketing, automation and newsletter plugin for WordPress with WooCommerce integration, running as server-side PHP that registers AJAX handlers via WordPress's admin-ajax.php. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): a request parameter is echoed into an HTML attribute context without output encoding. Two compounding weaknesses make this exploitable by unauthenticated actors: the AJAX response is not nonce-protected (no CSRF/request-origin validation) and the reflected value is not escaped for the attribute context (e.g., no esc_attr()), so an attacker can break out of the attribute and inject an event handler or script. The affected CPE is cpe:2.3:a:unknown:wemail:_email_marketing,_email_automation,_newsletters,_subscribers_&_email_optins_for_woocommerce, with the vulnerable code present in all releases prior to 2.1.3.

RemediationAI

Update the weMail plugin to version 2.1.3 or later, which contains the vendor fix (Patch available per vendor advisory; exact patched release: 2.1.3). Because exploitation requires a victim to click a crafted URL, until you can patch you can reduce exposure by deploying a WAF rule to filter script/attribute-breakout payloads on the plugin's admin-ajax.php requests, and by advising administrators not to open unsolicited links to the site - noting these are stopgaps that do not remove the underlying unescaped-reflection flaw. Restricting or monitoring access to the vulnerable AJAX action helps but may break legitimate plugin functionality if the endpoint is used by normal workflows. Refer to the WPScan advisory (https://wpscan.com/vulnerability/f00c1853-a4b2-4e91-99b3-fed8acbe6da7/) for confirmation of the fixed version.