CVE-2025-64200

MediumCVSS 5.9

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Email Template Customizer for WooCommerce plugin by VillaTheme up to version 1.2.17 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the victim's browser.

Risk Assessment

The risk includes potential data theft, session hijacking, or malware distribution within the WooCommerce store context.

Recommendation

It is recommended to update the Email Template Customizer for WooCommerce plugin to a version newer than 1.2.17 and sanitize all input data.

Other vulnerabilities in Email Template Customizer for WooCommerce

CVE-2026-103358High
A Code Injection vulnerability in VillaTheme Email Template Customizer for WooCommerce allows code injection. Affects versions up to 1.3.4.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.17.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS