CVE-2026-8089: weMail < 2.1.3 - Reflected Cross-Site Scripting

Synopsis

Reflected Cross-Site Scripting (XSS) affects the weMail WordPress plugin (Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce) in all versions before 2.1.3. The vulnerability is reachable over the network with no authentication required on the attacker's side, but requires a victim who is already logged in to click or load a crafted URL. Successful exploitation injects attacker-controlled script into the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions performed as the victim, including administrator-level operations. A patched-image rebuild at version 2.1.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted URL over the network, so the vulnerable AJAX endpoint must be reachable from the internet or an accessible network path.

• AuthenticationNot required

  No account or credential is needed on the attacker's side; the plugin reflects the malicious parameter without any privilege check.

• Victim interactionRequired

  A logged-in user (including an administrator) must follow or load the attacker-crafted URL for the injected script to execute in their browser session.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim loads the URL; no race conditions or special environmental factors are required.

Blast Radius

• Attacker-controlled JavaScript executes in the victim's authenticated browser session, enabling theft of session cookies or authentication tokens.
• The injected script can read and exfiltrate page content visible to the victim, including sensitive administrative data or subscriber records managed through weMail.
• Because the attack works against administrators, the script can issue privileged WordPress actions on the victim's behalf, such as creating rogue admin accounts or modifying plugin settings.
• Integrity of displayed page content is compromised for the duration of the attack, and availability of the victim's session may be disrupted if the payload redirects or locks the user out.