CVE-2026-97396

Name of the Vulnerable Software and Affected Versions Email Marketing for WordPress and WooCommerce – Retainful versions prior to 1.0.11

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the data parameter in the '/updateOptions' REST endpoint, enabling the injection of arbitrary web scripts that execute when a user accesses an affected page.

Recommendations Update Email Marketing for WordPress and WooCommerce – Retainful to version 1.0.11 or later. As a temporary mitigation, restrict access to the '/updateOptions' REST endpoint for users with subscriber-level permissions.