CVE-2026-97396: Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required from the attacker to submit the malicious data.
Which installations are affected?
Retainful Email Marketing for WordPress and WooCommerce versions through 1.0.10 are affected. The provided information does not identify a fixed version.
What happens after a successful exploit?
The attacker can store arbitrary web script through the data parameter of the /updateOptions REST endpoint. The script executes when a user visits a page where the injected content is rendered.
How can administrators reduce exposure before updating?
Limit or remove Subscriber and other low-privilege accounts that are not needed, since Subscriber-level access is sufficient for exploitation. Review accounts for unauthorized users and restrict access to the affected plugin functionality where possible.