Executive brief
Email Essentials is a WordPress plugin that handles email functionality for websites. An unauthenticated attacker can inject malicious scripts that execute in visitors' browsers, potentially stealing session cookies, hijacking user accounts, or harvesting personal information from site visitors.
Technical details
The WordPress Email Essentials plugin versions 6.0.6 and earlier contain a reflected or stored cross-site scripting (XSS) vulnerability that does not require authentication to trigger. The vulnerability likely stems from insufficient input validation or output encoding in a web-facing form or parameter. An attacker can craft a malicious URL or form submission containing JavaScript code that executes in the context of a victim's browser session, allowing session hijacking, credential theft, or malware distribution. The vulnerability has been patched in version 6.0.7.
Affected products
- Acato Email Essentials <=6.0.6
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Patched in version 6.0.7
- 2026-08-31: advisory: CVE-2026-81764 published