CVE-2026-103358

Deferred Deferred - Pending Action

Code Injection in Email Template Customizer for WooCommerce

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103358

EUVD

EUVD-2026-100987

Affected Vendors & Products

Vendor	Product	Version / Range
VillaTheme	Email	Template Customizer for WooCommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a code injection vulnerability in the VillaTheme Email Template Customizer for WooCommerce plugin. It allows attackers to inject malicious or unwanted content into web pages without authentication. The vulnerability exists in versions up to 1.3.4.

Detection Guidance

Check if the Email Template Customizer for WooCommerce plugin is installed and verify its version. If it is version 1.3.4 or earlier, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

Attackers could inject ads, scams, or malware links into your website. This could damage your site's reputation, mislead visitors, or spread malware to users. The vulnerability has a CVSS score of 7.5, indicating a moderate risk.

Compliance Impact

This vulnerability could lead to unauthorized content injection, potentially exposing sensitive user data or violating data integrity. For GDPR, this may result in unauthorized data processing or breaches. For HIPAA, it could compromise protected health information if injected content manipulates forms or displays.

Mitigation Strategies

Immediately update the Email Template Customizer for WooCommerce plugin to version 1.3.5 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is applied.

Hi! I’m here to help you understand CVE-2026-103358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70