CVE-2026-103358: WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/email-template-customizer-for-wooto a version that resolves this vulnerability.Fixed in 1.3.5
Event History
Frequently Asked Questions
Which installations are affected?
Installations of VillaTheme Email Template Customizer for WooCommerce are affected through version 1.3.4. The issue is identified in the email-template-customizer-for-woo plugin.
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the stated security impact?
The vulnerability is rated high with a CVSS score of 7.5. The vector indicates high confidentiality impact, with no stated integrity or availability impact.