WordPress plugin
Kadence WooCommerce Email Designer security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 7 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium2
- Low0
All Kadence WooCommerce Email Designer vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.6 | Authenticated (Shop Manager+) PHP Object Injection ≤1.5.19.1Update to 1.5.19.2 | CVE-2026-94677 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤1.5.19Update to 1.5.19.1 | CVE-2026-28005 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.5.17Update to 1.5.18 | CVE-2025-13387 | |
| High7.2 | Authenticated (Shop Manager+) Arbitrary Options Update ≤1.5.16Update to 1.5.17 | CVE-2025-54697 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload ≤1.5.14Update to 1.5.15 | CVE-2025-39557 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.5.11Update to 1.5.12 | CVE-2023-47186 | |
| High7.2 | PHP Object Injection ≤1.5.6Update to 1.5.7 | CVE-2022-3335 |
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
≤1.5.19.1Update to 1.5.19.2
- Critical9.8Unauthenticated Privilege Escalation
≤1.5.19Update to 1.5.19.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.5.17Update to 1.5.18
- High7.2Authenticated (Shop Manager+) Arbitrary Options Update
≤1.5.16Update to 1.5.17
- High7.2Authenticated (Admin+) Arbitrary File Upload
≤1.5.14Update to 1.5.15
- Medium4.3Cross-Site Request Forgery
≤1.5.11Update to 1.5.12
- High7.2PHP Object Injection
≤1.5.6Update to 1.5.7
Kadence WooCommerce Email Designer: common questions
Does Kadence WooCommerce Email Designer have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in Kadence WooCommerce Email Designer: 1 critical, 4 high, 2 medium. None are known to affect version null.
How do I check which version of Kadence WooCommerce Email Designer I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Kadence WooCommerce Email Designer vulnerability?
CVE-2026-94677, published Sep 24, 2026: Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection. Severity: Medium (CVSS 6.6).
Is any Kadence WooCommerce Email Designer vulnerability listed in CISA KEV?
No. None of the known Kadence WooCommerce Email Designer vulnerabilities is currently listed in the CISA KEV catalog.