CVE-2026-97396: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in retainful Email Marketing for WordPress and WooCommerce – Retainful

CVE-2026-97396 is a stored Cross-Site Scripting (CWE-79) vulnerability in the Email Marketing for WordPress and WooCommerce – Retainful plugin. It affects all versions from 0 up to and including 1.0.10. The flaw is due to insufficient input sanitization and output escaping of the 'data' parameter, which allows authenticated attackers with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who visit the injected pages, potentially leading to information disclosure or session hijacking. The CVSS v3.1 score is 6.4, indicating medium severity, with network attack vector, low attack complexity, and privileges required at the level of a subscriber.

An attacker with subscriber-level access or higher can inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no direct impact on availability. The vulnerability requires authentication and is exploitable over the network.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict subscriber-level access to trusted users only and consider disabling or limiting use of the affected plugin. Implementing web application firewall (WAF) rules to detect and block suspicious input may provide temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.