CVE-2026-97396

Deferred Deferred - Pending Action

Stored XSS in Retainful for WordPress and WooCommerce

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Wordfence

Description

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97396

EUVD

EUVD-2026-96280

Affected Vendors & Products

Vendor	Product	Version / Range
retainful	Email	Marketing for WordPress and WooCommerce – Retainful 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Retainful plugin for WordPress and WooCommerce. It exists in versions up to 1.0.10 due to insufficient input sanitization and output escaping in the 'data' parameter. Attackers with subscriber-level access or higher can inject malicious scripts into web pages.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Retainful plugin versions up to 1.0.10 for stored XSS via the 'data' parameter. Check for unauthorized scripts in pages or posts. Use WordPress admin access logs to identify suspicious subscriber-level activity.

Impact Analysis

If exploited, this vulnerability allows attackers to inject arbitrary scripts into pages. When users access these pages, the scripts execute, potentially stealing user data, session cookies, or performing actions on behalf of the user. It requires authenticated access but can affect all visitors to the site.

Compliance Impact

This vulnerability could lead to data breaches, compromising user data and violating privacy regulations like GDPR and HIPAA. It may result in unauthorized access to sensitive information, leading to legal penalties, reputational damage, and loss of user trust.

Mitigation Strategies

Immediately update the Retainful plugin to the latest version. Remove or restrict subscriber-level access if not required. Review and sanitize all user inputs, especially the 'data' parameter. Monitor for unusual script injections in pages.

Hi! I’m here to help you understand CVE-2026-97396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70