WordPress plugin
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium9
- Low2
All weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Low2.7 | Authenticated (Editor+) Information Exposure <2.1.7Update to 2.1.7 | CVE-2026-104648 | |
| Low2.7 | Missing Authorization <2.1.7Update to 2.1.7 | CVE-2026-104647 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.1.2Update to 2.1.3 | CVE-2026-57322 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.1.2Update to 2.1.3 | CVE-2026-8089 | |
| Medium6.5 | Missing Authorization to Unauthenticated Form Deletion ≤2.0.7Update to 2.0.8 | CVE-2025-14339 | |
| Medium5.3 | Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure ≤2.0.7Update to 2.0.8 | CVE-2025-14348 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure ≤1.14.13Update to 1.14.14 | CVE-2025-47540 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.14.5Update to 1.14.6 | CVE-2024-43238 | |
| Medium5.3 | Missing Authorization to Notice Dismissal ≤1.14.2Update to 1.14.3 | CVE-2024-34822 | |
| Medium4.3 | Missing Authorization ≤3.6.0Update to 3.6.1 | — | |
| Medium4.3 | Cross-Site Request Forgery ≤3.6.0Update to 3.6.1 | CVE-2022-47150 |
- Low2.7Authenticated (Editor+) Information Exposure
<2.1.7Update to 2.1.7
- Low2.7Missing Authorization
<2.1.7Update to 2.1.7
- Medium6.1Reflected Cross-Site Scripting
≤2.1.2Update to 2.1.3
- Medium6.1Reflected Cross-Site Scripting
≤2.1.2Update to 2.1.3
- Medium6.5Missing Authorization to Unauthenticated Form Deletion
≤2.0.7Update to 2.0.8
- Medium5.3Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure
≤2.0.7Update to 2.0.8
- Medium5.3Unauthenticated Sensitive Information Exposure
≤1.14.13Update to 1.14.14
- Medium6.1Reflected Cross-Site Scripting
≤1.14.5Update to 1.14.6
- Medium5.3Missing Authorization to Notice Dismissal
≤1.14.2Update to 1.14.3
- Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
- Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce: common questions
Does weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce: 9 medium, 2 low. At least one is not fixed in the latest version.
How do I check which version of weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce vulnerability?
CVE-2026-104648, published Nov 3, 2026: weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce < 2.1.7 - Authenticated (Editor+) Information Exposure. Severity: Low (CVSS 2.7).
Is any weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce vulnerability listed in CISA KEV?
No. None of the known weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.