CVE-2026-8599 Overview
CVE-2026-8599 is a Stored Cross-Site Scripting (XSS) vulnerability in the MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress. The flaw affects all versions up to and including 2.0.4. The Campaign HTML Content Field fails to apply sufficient input sanitization and output escaping, allowing authenticated attackers with author-level access or higher to inject arbitrary web scripts. Injected payloads execute when other users access the affected admin pages. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is unaffected because it enforces a Content-Security-Policy header that blocks inline scripts. Exploitation is therefore limited to the admin dashboard preview context. The issue is tracked under [CWE-79].
Critical Impact
Authenticated authors can inject persistent JavaScript that executes in administrator browsers viewing the campaign preview, enabling session theft, privilege escalation through forced actions, and admin dashboard takeover.
Affected Products
- MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress
- All versions through 2.0.4
- WordPress sites permitting author-level or higher user registration
Discovery Timeline
- 2026-06-09 - CVE-2026-8599 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-8599
Vulnerability Analysis
The vulnerability resides in how MailerPress processes the HTML content field used to compose email campaigns. The plugin accepts user-supplied HTML through its Campaigns API and renders it back into the WordPress admin interface without applying sufficient sanitization filters or contextual output escaping. Because campaign content is intentionally HTML-rich, the plugin treats inline markup as legitimate input, but it fails to strip script-bearing constructs before persisting and re-rendering the data. The relevant code paths are visible in MailerPress Campaign API at line 2100, line 2128, and line 2137, as well as the Shortcode Action handler.
Root Cause
The root cause is missing input sanitization on campaign HTML content during write operations and missing output escaping during render. WordPress provides helper functions such as wp_kses_post() and esc_html() to safely handle rich content, but these are not applied to the Campaign HTML Content Field. Stored payloads persist in the database and execute every time a privileged user opens the campaign preview inside /wp-admin.
Attack Vector
An attacker authenticates as an author or higher-privileged user, creates or edits a campaign, and submits a payload containing JavaScript inside the HTML content field through the Campaigns REST endpoint. When an administrator subsequently opens the admin dashboard preview, the script executes in the administrator's browser context. The public preview at /mp-email/{id}-slug/ is shielded by a Content-Security-Policy header blocking inline scripts, so exploitation is constrained to the authenticated admin UI. The attacker can leverage the execution to issue authenticated REST calls, create administrator accounts, or exfiltrate session data.
Detection Methods for CVE-2026-8599
Indicators of Compromise
- Campaign records in the MailerPress database containing <script>, onerror=, onload=, or javascript: substrings within the HTML content field.
- Unexpected administrator account creation or role changes following access to the MailerPress campaign preview screen.
- Outbound requests from admin browsers to unfamiliar domains after viewing campaigns authored by lower-privileged users.
Detection Strategies
- Query the wp_posts and MailerPress campaign tables for HTML payloads containing event handlers or script tags introduced by non-administrator users.
- Review WordPress audit logs for campaign create or update REST API calls (/wp-json/mailerpress/) originating from author-level accounts.
- Monitor browser console errors and CSP violation reports from admin sessions accessing campaign previews.
Monitoring Recommendations
- Enable WordPress activity logging plugins to track campaign edits with diff-level visibility.
- Alert on any new administrator user creation that occurs within minutes of a campaign preview being opened.
- Track REST API requests to MailerPress endpoints by user role to surface anomalous author-level activity.
How to Mitigate CVE-2026-8599
Immediate Actions Required
- Update the MailerPress plugin to version 2.0.5 or later, which addresses the sanitization gap in the Campaigns API.
- Audit existing campaigns for malicious HTML and remove or sanitize any payloads introduced by non-administrator accounts.
- Restrict author-and-above access to trusted users only, and review recently created accounts on affected sites.
Patch Information
The vendor addressed the vulnerability in MailerPress 2.0.5. The fixed code is visible in the updated Campaigns API at line 2229 and line 4713. Refer to the Wordfence Vulnerability Analysis for additional remediation context.
Workarounds
- Temporarily downgrade author-level accounts to contributor or lower until the patch is applied.
- Apply a Web Application Firewall (WAF) rule to block requests to the MailerPress Campaigns REST endpoints containing <script or common XSS event handler patterns.
- Add a strict Content-Security-Policy header to the WordPress admin interface that disallows inline scripts from rendered campaign content.
# Update MailerPress via WP-CLI
wp plugin update mailerpress --version=2.0.5
wp plugin status mailerpress
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
