CVE-2026-8089

Name of the Vulnerable Software and Affected Versions weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin versions prior to 2.1.3

Description The plugin fails to properly escape a user-supplied parameter before reflecting it into an HTML attribute within a non-nonce-protected AJAX response. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation, allowing the execution of malicious scripts in the victim's browser. This can be executed against any authenticated user, including administrators, via a crafted URL.

Recommendations Update to version 2.1.3 or later.