plugin
12 known security issues reported for the Kadence Woocommerce Email Designer WordPress plugin. Most recent disclosed Aug 4, 2026.
Running Kadence Woocommerce Email Designer on your site? Check whether your installed version is affected.
Scan your site freeThe Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.5.19. This makes it possible for unauthenticated attackers to elevate their privileges.
[en] The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to insufficient input validation on the import_woomail() function in all versions up to, and including, 1.5.16. This makes it possible for authenticated attackers, wit...
[en] Incorrect Privilege Assignment vulnerability in Ben Ritner - Kadence WP Kadence WooCommerce Email Designer allows Privilege Escalation. This issue affects Kadence WooCommerce Email Designer: from n/a through 1.5.16.
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.5.14. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected s...
[en] Unrestricted Upload of File with Dangerous Type vulnerability in Ben Ritner - Kadence WP Kadence WooCommerce Email Designer allows Upload a Web Shell to a Web Server. This issue affects Kadence WooCommerce Email Designer: from n/a through 1.5.14.
[en] Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.11. This is due to missing or incorrect nonce validation on the ajax_reset() and ajax_send_email() functions. This makes it possible for unauthenticated attackers to send tes...
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.11. This is due to missing or incorrect nonce validation on the ajax_reset() and ajax_send_email() functions. This makes it possible for unauthenticated attackers to send tes...
[en] The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
The Kadence WooCommerce Email Designer for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.6 via deserialization of untrusted input via the 'raw' parameter in the import_woomail function. This allows administrator-level attackers or higher to inject a PHP Object. No POP chain appea...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free