Trithem

**Name of the Vulnerable Software and Affected Versions** Email Marketing for WordPress and WooCommerce – Retainful versions prior to 1.0.11 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `data` parameter in the '/updateOptions' REST endpoint, enabling the injection of arbitrary web scripts that execute when a user accesses an affected page. **Recommendations** Update Email Marketing for WordPress and WooCommerce – Retainful to version 1.0.11 or later. As a temporary mitigation, restrict access to the '/updateOptions' REST endpoint for users with subscriber-level permissions.