WordPress security by component
Kadence WooCommerce Email Designer
Plugin description
Kadence WooCommerce Email Designer is a WordPress component with 5 published CVE records in this archive. The latest tracked vulnerability was published Dec 02, 2025; the highest CVE/CNA score is 9.1.
Plugin slug:
kadence-woocommerce-email-designerLatest vulnerability
CVE-2025-13387: Kadence WooCommerce Email Designer: Cross-site scripting
Kadence WooCommerce Email Designer is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
| Safe version |
|
||
|---|---|---|---|
| Dec 02, 2025 |
CVE-2025-13387
Kadence WooCommerce Email Designer: Cross-site scripting
Kadence WooCommerce Email Designer is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Aug 14, 2025 |
CVE-2025-54697
Kadence WooCommerce Email Designer: Privilege escalation or authentication bypass
Kadence WooCommerce Email Designer is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Apr 16, 2025 |
CVE-2025-39557
Kadence WooCommerce Email Designer: Dangerous file upload
Kadence WooCommerce Email Designer is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.1
NVDPending
|
| Nov 06, 2023 |
CVE-2023-47186
Kadence Woocommerce Email Designer: Cross-site request forgery
Kadence Woocommerce Email Designer is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Oct 25, 2022 |
CVE-2022-3335
Kadence WooCommerce Email Designer: Code execution
Kadence WooCommerce Email Designer is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
NVD7.2
|