CVE-2026-8089

Description

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.

PUBLISHED Reserved 2026-05-07 | Published 2026-06-17 | Updated 2026-06-17 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Credits

John Umoru finder

WPScan coordinator

References

wpscan.com/...rability/f00c1853-a4b2-4e91-99b3-fed8acbe6da7/ exploit vdb-entry technical-description

cve.org (CVE-2026-8089)

nvd.nist.gov (CVE-2026-8089)

Download JSON