CVE-2026-1943: YayMail WooCommerce Email Customizer XSS

CVE-2026-1943 Overview

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled.

Critical Impact

Authenticated attackers with Shop Manager privileges can inject persistent malicious scripts that execute in the browsers of other users accessing affected pages, potentially leading to session hijacking, account compromise, or further attacks against site administrators.

Affected Products

• YayMail – WooCommerce Email Customizer plugin versions up to and including 4.3.2
• WordPress multi-site installations using vulnerable YayMail versions
• WordPress installations with unfiltered_html capability disabled

Discovery Timeline

• 2026-02-18 - CVE-2026-1943 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1943

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) stems from improper handling of user-supplied input within the YayMail plugin's template settings functionality. The attack requires network access and authentication with at least Shop Manager-level privileges, making it exploitable through the WordPress admin interface. The vulnerability has a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component itself—specifically, it can affect users who view pages containing the injected scripts.

The vulnerability specifically manifests in the plugin's template controller and element rendering components. When attackers with sufficient privileges submit malicious payloads through the plugin's settings interface, the lack of proper sanitization allows script content to be stored in the database. Subsequently, when these templates are rendered, the unsanitized output enables arbitrary JavaScript execution in victim browsers.

Root Cause

The root cause of CVE-2026-1943 is insufficient input sanitization and output escaping within the YayMail plugin's template handling code. Multiple components are affected, including the TemplateController.php file and template element files such as order-details.php and text.php. The plugin fails to properly sanitize user input before storing it and does not adequately escape output when rendering template content, creating the conditions necessary for Stored XSS attacks.

This is particularly relevant in WordPress multi-site environments where users with the Shop Manager role typically have restricted HTML capabilities due to the unfiltered_html capability being disabled by default.

Attack Vector

The attack vector for this vulnerability is network-based and requires authentication with elevated privileges. An attacker with Shop Manager-level access or higher can exploit this vulnerability by:

1. Accessing the YayMail plugin settings within the WordPress admin dashboard
2. Injecting malicious JavaScript code into template settings fields
3. Saving the template configuration, which stores the payload in the database
4. When other users (including administrators) access pages that render the affected templates, the injected scripts execute in their browser context

The malicious scripts can be used to steal session cookies, perform actions on behalf of authenticated users, redirect users to malicious sites, or escalate privileges within the WordPress installation. The vulnerability is particularly impactful because email customizer templates are frequently accessed by store administrators reviewing email configurations.

Technical details of the vulnerable code paths can be found in the WordPress YayMail Template Controller, Order Details Template, and Text Template files.

Detection Methods for CVE-2026-1943

Indicators of Compromise

• Unexpected JavaScript code or <script> tags within YayMail template settings or database entries
• Unusual modifications to email template configurations by Shop Manager accounts
• Browser-based security alerts or XSS detection warnings when accessing plugin settings
• Suspicious HTTP requests to external domains originating from WordPress admin pages

Detection Strategies

• Review YayMail template configurations for embedded script tags or JavaScript event handlers
• Monitor WordPress database tables associated with YayMail plugin settings for unexpected HTML content
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to plugin settings endpoints
• Enable browser Content Security Policy (CSP) headers to detect and block inline script execution

Monitoring Recommendations

• Configure real-time monitoring for changes to YayMail plugin settings in WordPress
• Enable audit logging for all Shop Manager and higher privilege account activities
• Deploy endpoint detection solutions capable of identifying browser-based script injection attacks
• Monitor network traffic for suspicious data exfiltration attempts from admin user sessions

How to Mitigate CVE-2026-1943

Immediate Actions Required

• Update the YayMail – WooCommerce Email Customizer plugin to a patched version above 4.3.2
• Review existing YayMail template configurations for any signs of injected malicious content
• Audit Shop Manager and administrator account activities for unauthorized changes
• Consider temporarily restricting Shop Manager access to plugin settings until the patch is applied

Patch Information

The vulnerability affects YayMail versions up to and including 4.3.2. Plugin maintainers have addressed this issue in subsequent releases. Review the WordPress YayMail Changeset Log for detailed patch information. Additional vulnerability details are available in the Wordfence CVE Vulnerability Report.

Workarounds

• If immediate patching is not possible, temporarily disable the YayMail plugin until an update can be applied
• Restrict Shop Manager role capabilities to prevent access to plugin settings pages
• Implement additional input validation at the web server or WAF level for requests to YayMail endpoints
• Enable WordPress security plugins that provide real-time XSS attack detection and blocking

# WordPress CLI command to check YayMail plugin version
wp plugin list --name=yaymail --fields=name,version,status

# Update YayMail plugin to latest version
wp plugin update yaymail

# Verify plugin version after update
wp plugin get yaymail --field=version