Email Marketing For Wordpress And Woocommerce Retainful
Monthly
Stored cross-site scripting (XSS) in the Retainful Email Marketing for WordPress and WooCommerce plugin (versions ≤1.0.10) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'data' parameter in the plugin's REST API, which execute when a victim views the affected page. This vulnerability requires a low-privilege account and user interaction, and no public exploit code or active exploitation has been identified. It is a moderate-severity (CVSS 6.4) issue that should be patched promptly.
Stored cross-site scripting (XSS) in the Retainful Email Marketing for WordPress and WooCommerce plugin (versions ≤1.0.10) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'data' parameter in the plugin's REST API, which execute when a victim views the affected page. This vulnerability requires a low-privilege account and user interaction, and no public exploit code or active exploitation has been identified. It is a moderate-severity (CVSS 6.4) issue that should be patched promptly.