CVE-2026-93889 is a stored cross-site scripting vulnerability in the Mail logging – WP Mail Catcher WordPress plugin (versions up to 2.1.12). The flaw exists because PHPMailer includes unsanitized user input from mail fields in its 'wp_mail_failed' error messages. If a separately installed plugin like Contact Form 7 passes unauthenticated user input into these mail fields, an attacker can inject malicious scripts that execute in the context of users viewing the affected pages. This vulnerability allows code injection without authentication and can lead to partial confidentiality and integrity impacts.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users viewing the injected pages, potentially leading to information disclosure and manipulation of content (confidentiality and integrity impacts). There is no direct availability impact. The vulnerability requires a second plugin that forwards user input into mail fields, making exploitation dependent on the environment.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. As a mitigation, avoid using the Mail logging – WP Mail Catcher plugin together with plugins that forward unauthenticated user input into mail fields, such as Contact Form 7, until a fix is available. Implementing input sanitization and output escaping on mail failure messages would be necessary to fully remediate the issue once a patch is released.