CVE-2026-8599: MailerPress Stored XSS Vulnerability in WordPress Campaign HTML

Technical summary

CVE-2026-8599 is a Stored Cross-Site Scripting (XSS) vulnerability in MailerPress versions up to 2.0.4. The Campaign HTML Content Field fails to sanitize input, allowing authenticated users with author permissions or above to persist arbitrary JavaScript into campaign records. Upon admin preview of a campaign in the WordPress dashboard, the unsanitized HTML is reflected without proper output encoding, resulting in script execution within the admin context. The public campaign preview endpoint (/mp-email/{id}-slug/) mitigates this via Content-Security-Policy headers that block inline script execution, limiting exploitation scope to the admin dashboard. The CVSS 3.1 score of 6.4 (MEDIUM) reflects network accessibility, low privilege requirements, and cross-site impact, though availability is not affected.

Business impact

A compromised author account or an insider with such permissions could inject scripts that steal WordPress admin session tokens, create new admin users, modify campaign content, or perform other administrative actions without further authentication. The attack requires the victim (an admin) to preview the malicious campaign, but since campaign review is a routine operational task, exploitation likelihood is elevated. Sites relying on MailerPress for customer communications could face data theft, site defacement, or loss of campaign integrity. Affected organizations should prioritize patching to prevent lateral movement and privilege escalation from author-level compromise.

Affected systems

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress in all versions up to and including 2.0.4. The vulnerability does not affect the public-facing campaign preview endpoint, which is protected by Content-Security-Policy headers. Exploitation is limited to the WordPress admin dashboard, so any WordPress site with MailerPress installed and author-level (or higher) users is at risk.

Exploitability

Exploitation requires authenticated access with author-level permissions or above. No user interaction is needed beyond the attacker crafting a campaign with injected script and an admin user viewing the campaign preview—a routine administrative workflow. The attack surface is limited to the admin dashboard; the public-facing campaign URL is not vulnerable due to existing CSP protections. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates low complexity and no required user interaction, but privilege requirements and lack of availability impact keep the score at MEDIUM. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update MailerPress to a patched version released after 2.0.4. Verify the specific patched version number in the official MailerPress release notes or vendor advisory. As an interim control, restrict author-level access to trusted individuals and monitor WordPress user activity for suspicious account creation or privilege escalation. Implement Web Application Firewall rules to detect script injection patterns in campaign submissions if patching is delayed.

Patch guidance

Upgrade MailerPress to the earliest available version after 2.0.4 that addresses this vulnerability. Verify the exact version number against the plugin's official release notes, changelog, or the vendor's security advisory. Test the update in a staging environment to ensure compatibility with your WordPress version and other active plugins before deploying to production. After patching, confirm that existing campaigns render correctly in both the admin preview and public-facing endpoints.

Detection guidance

Monitor WordPress admin logs for suspicious campaign previews or rapid creation and deletion of campaigns. Search your campaign database (typically in wp_postmeta for MailerPress) for HTML content containing script tags, event handlers (onclick, onload, etc.), or encoded JavaScript payloads. Use WordPress security plugins to audit author-level user activity, particularly around campaign creation and modification. If you can export campaign HTML, grep for patterns like '<script', 'javascript:', 'onerror=', and 'onload=' to identify potential injected content. Review admin session logs for unusual actions following campaign preview activities.

Why prioritize this

This vulnerability merits prompt patching despite its MEDIUM CVSS score because (1) it enables privilege escalation and lateral movement within WordPress from a relatively low-privilege account; (2) exploitation is simple and requires no external interaction; (3) author-level accounts are common and may be less carefully managed than admin accounts; and (4) the attack leaves few obvious traces in the public-facing application. Organizations should prioritize this after critical and high-severity issues but ahead of lower-impact MEDIUM vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a balance of factors: network accessibility (AV:N) and low attack complexity (AC:L) elevate risk, but the requirement for authenticated access with privileges (PR:L) and the absence of availability impact (A:N) prevent a higher score. The cross-site scope (S:C) and confidentiality/integrity impacts (C:L/I:L) contribute to the MEDIUM severity. For risk prioritization, also consider your organization's reliance on MailerPress, the number of authors with plugin access, and the sensitivity of email campaigns they control.

Frequently asked questions