Junglewise Threat Intelligence

CVE-2026-8599: MailerPress WordPress plugin stored XSS in Campaign HTML Content Field

CVE-2026-8599 · Severity: medium · CVSS 6.4 · Published 2026-06-09

Executive brief

A vulnerability in the MailerPress WordPress plugin, used for email marketing and newsletters, allows authorized users with author-level permissions to inject malicious scripts into email campaign fields. These scripts execute when an administrator views the campaign in the dashboard, potentially leading to unauthorized actions or data access within the site management interface. Public-facing pages are protected by security headers, so the risk is primarily focused on internal administrative users.

Technical details

The MailerPress plugin for WordPress (versions <= 2.0.4) contains a Stored Cross-Site Scripting (XSS) vulnerability within the Campaign HTML Content Field. The root cause is a failure to properly sanitize input and escape output in the campaign creation/editing workflow. Authenticated attackers with 'author' privileges or higher can inject malicious JavaScript that executes when another user (typically an administrator) views the campaign preview within the WordPress admin dashboard. While the public-facing campaign preview endpoint (/mp-email/{id}-slug/) is protected by a Content-Security-Policy (CSP) that blocks inline scripts, the administrative interface lacks this protection. The issue is addressed in version 2.0.5.

Affected products

  • MailerPress MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails up to, and including, 2.0.4

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory

References