The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin versions prior to 2.1.3 improperly handle user input by failing to escape a parameter before reflecting it in an HTML attribute within an AJAX response that lacks nonce protection. This vulnerability enables unauthenticated attackers to perform reflected Cross-Site Scripting (CWE-79) attacks against any authenticated user who accesses a crafted URL, potentially leading to script execution in the context of the victim's session.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of authenticated users, including administrators. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other malicious activities within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's AJAX endpoints to trusted users and avoid clicking on suspicious URLs. Monitor vendor channels for updates regarding a patch or official mitigation.