PatchSiren cyber security CVE debrief
CVE-2026-8048 paulpela CVE debrief
A stored cross-site scripting (XSS) vulnerability exists in the My Email Shortcode WordPress plugin. The flaw resides in the 'subject' attribute of the 'my-email' shortcode, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses a page containing the injected shortcode. The vulnerability affects all versions up to and including 0.91. The issue was disclosed on 2026-05-27 with a CVSS 3.1 score of 6.4 (Medium severity). No known exploitation in ransomware campaigns has been reported.
- Vendor
- paulpela
- Product
- My Email Shortcode
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
WordPress site administrators, security teams managing WordPress installations, developers maintaining custom shortcode implementations, and organizations with Contributor-level user workflows.
Technical summary
The My Email Shortcode plugin for WordPress fails to sanitize and escape the 'subject' attribute in its 'my-email' shortcode. Authenticated users with Contributor role or higher can supply malicious JavaScript payloads in this attribute. When the shortcode is rendered on a page, the unsanitized output is delivered to browsers, executing the attacker-supplied script in the context of the viewing user's session. The vulnerability is present in the plugin's PHP source at line 37 of my-email-shortcode.php through version 0.91.
Defensive priority
medium
Recommended defensive actions
- Update My Email Shortcode plugin to version 0.92 or later when available
- Apply principle of least privilege: restrict Contributor and Author roles where possible
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
- Review existing posts and pages for suspicious shortcode usage in 'subject' attributes
- Consider Web Application Firewall (WAF) rules to filter malicious shortcode input
- Audit user accounts with Contributor-level access or higher for compromise indicators
Evidence notes
Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code analysis. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Official resources
2026-05-27