Is CVE-2026-57416 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57416 being exploited in the wild.

How severe is CVE-2026-57416?

High severity, with a CVSS score of 7.1, published 13 July 2026.

Which products and versions are affected?

SiteGround Email Marketing through 1.7.5.

Is there a fix for CVE-2026-57416?

A patch was published on 2026-07-13: Patch confirmed available in version 1.7.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57416 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57416?

Check whether you run SiteGround Email Marketing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57416: SiteGround SiteGround Email Marketing stored XSS

CVE-2026-57416 · Severity: high · CVSS 7.1 · Published 2026-07-13

The SiteGround Email Marketing plugin for WordPress is vulnerable to a security flaw that allows attackers to inject malicious scripts into a website. This plugin is used by site owners to manage email campaigns and subscriber lists. If exploited, an attacker could redirect visitors to malicious websites, steal session information, or deface the site, potentially damaging the organization's reputation and compromising user data.

Vendors: SiteGround.

Quick answers

Is CVE-2026-57416 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57416 being exploited in the wild.
How severe is CVE-2026-57416?: High severity, with a CVSS score of 7.1, published 13 July 2026.
Which products and versions are affected?: SiteGround Email Marketing through 1.7.5.
Is there a fix for CVE-2026-57416?: A patch was published on 2026-07-13: Patch confirmed available in version 1.7.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57416 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57416?: Check whether you run SiteGround Email Marketing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the SiteGround Email Marketing plugin for WordPress due to improper neutralization of input during web page generation. The flaw allows an unauthenticated remote attacker to inject malicious scripts (such as redirects or advertisements) into the website. Successful exploitation requires a privileged user to interact with the malicious content, such as visiting a specific page or clicking a link. Once executed, the script runs in the context of the victim's browser, potentially leading to session hijacking or unauthorized actions. The issue is fixed in version 1.7.6.

Affected products

SiteGround SiteGround Email Marketing through 1.7.5

Timeline

2026-05-18: other: Vulnerability reported by researcher xwii
2026-07-08: advisory: Patchstack advisory published
2026-07-13: disclosed: CVE published to NVD dataset
2026-07-13: patched: Patch confirmed available in version 1.7.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.