CVE-2026-8599
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The MailerPress plugin for WordPress up to version 2.0.4 is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. The public campaign preview endpoint (/mp-email/{id}-slug/) is not affected due to a Content-Security-Policy header blocking inline scripts; exploitation is limited to the admin dashboard preview.
Risk Assessment
An attacker can inject a malicious script that executes in the context of an administrator session, potentially leading to session theft, content modification, or further attacks.
Recommendation
Update the MailerPress plugin to the latest available version that contains the fix.
Other vulnerabilities in MailerPress
See all- CVE-2026-18437Medium
The MailerPress plugin for WordPress up to version 1.5.0 is vulnerable to unauthorized access due to a missing capability check on the REST API endpoint `mailerpress/v1/contact`. This allows unauthenticated attackers to update contact details.
- CVE-2026-57410High
The MailerPress plugin up to version 2.0.2 contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this flaw to gain higher privileges within the system.
Original NVD description (English source)
The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is not affected by this vulnerability, as it applies a Content-Security-Policy header blocking all inline scripts; exploitation is limited to the admin dashboard preview.