WordPress My Email Shortcode <=0.91 Stored XSS Vulnerability (CVE-2026-8048)

Vulnerability Overview Vulnerability Name: My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] CVSS Score: 6.4 (Medium) CVE Number: CVE-2026-8048 Publication Date: May 26, 2026 Last Updated Date: May 27, 2026 Researcher: zakaria Impact Scope Software Type: Plugin Software Slug: my-email-shortcode Fixed: No Affected Versions: <= 0.91 Remediation Current Status: No known patch available. Recommended Actions: Carefully review the vulnerability details and implement mitigation measures according to your organization's risk tolerance. Uninstalling the affected software and seeking alternatives may be necessary. Additional Information Vulnerability Description: The My Email Shortcode plugin contains a stored Cross-Site Scripting (XSS) vulnerability in WordPress, affecting versions 0.91 and below via the 'subject' and 'my-email' shortcodes. Due to insufficient input sanitization and output escaping, attackers can inject arbitrary web scripts that execute when users visit the injected page. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org Copyright Information Copyright: 2012-2026 Defiant Inc. License: Used under the terms of Defiant Inc. license. Contact Information Contact Email: wfsupport@wordfence.com Business Hours Working Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support Service: 24/7 support, 365 days a year, with a 1-hour response time Additional Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Email Documentation Links Documentation Subscription Stay Updated Sign up for news and updates from our panel of experienced security professionals. Footer © 2012-2026 Defiant Inc. All Rights Reserved ENTRUST --- Summary This page details a stored Cross-Site Scripting (XSS) vulnerability in the My Email Shortcode plugin, affecting versions <= 0.91. Currently, there is no known patch; users are advised to uninstall the affected software and seek alternatives. The page provides detailed vulnerability descriptions, reference links, copyright information, contact details, business hours, social media links, documentation links, and subscription options.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress My Email Shortcode <=0.91 Stored XSS Vulnerability (CVE-2026-8048)