What is the CVSS score of EUVD-2026-39734?

EUVD-2026-39734 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of weMail are affected by EUVD-2026-39734?

weMail WordPress plugin versions 2.1.2 and earlier contain a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into WordPress sites.

How to fix or mitigate EUVD-2026-39734?

24 hours: Audit all WordPress installations for weMail plugin versions ≤2.1.2; document affected sites and user count. 7 days: Deactivate or remove the vulnerable weMail plugin from affected installations and identify alternative email functionality. 30 days: Monitor weMail project repository and vendor advisories for patch release; when available, test and deploy patched version (>2.1.2) to all affected instances.

weMail EUVD-2026-39734

| CVE-2026-57322 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-rq3h-6r32-7r52

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needs no auth (PR:N) but requires victim click (UI:R); script crosses into browser context (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:51 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.

AnalysisAI

Reflected cross-site scripting in the weMail WordPress plugin (versions 2.1.2 and earlier) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that the injected script runs in the WordPress site context, potentially affecting authenticated admin sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

weMail is a WordPress email-marketing and newsletter plugin used to build campaigns, manage subscribers, and send mail from within wp-admin. The flaw is a classic CWE-79 reflected XSS: user-controllable input (a request parameter) is echoed back into an HTML response without proper output encoding or input sanitization, so a payload supplied in the URL is rendered as live markup. Because it is reflected (not stored), the malicious value must be delivered to the victim per-request rather than persisting on the server. The CVSS scope change (S:C) indicates the script executes beyond the vulnerable component, i.e. in the browser security context of any user - including privileged WordPress administrators - who loads the crafted request.

RemediationAI

Upgrade the weMail plugin to a release later than 2.1.2 once the vendor publishes a patched version; the available data does not list an exact fixed version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wemail/vulnerability/wordpress-wemail-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability) and the WordPress plugin changelog for the corrected build - No vendor-released patch version identified at time of analysis. Until a fixed version is confirmed, deploy a web application firewall or Patchstack's virtual patching to filter XSS payloads on the plugin's endpoints, and train administrators not to click weMail-related links from untrusted sources (the attack requires victim interaction). Restricting wp-admin access to known IP ranges further limits exposure of privileged sessions, at the cost of remote-admin convenience.