CVE-2026-81764: WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Email Essentials Pluginto a version that resolves this vulnerability.Fixed in 6.0.7
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is described as unauthenticated, so the attacker does not need a WordPress account or other authenticated access. Exploitation does require user interaction, as indicated by the UI:R vector.
Which installations should be treated as affected?
Email Essentials versions 6.0.6 and earlier are identified as affected. The provided information does not state whether any particular WordPress configuration or feature must be enabled.
What impact could successful exploitation have?
The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. The vulnerability is categorized as cross-site scripting, meaning attacker-controlled script execution is the relevant risk.