Make Email Customizer For Woocommerce Vulnerabilities

[en] The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Nov 11, 2025

CVE-2025-11237 on NVD →

The Make Email Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'save_meta' function in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subs...

CVSS:

8.8

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Oct 21, 2025

CVE-2025-11237 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce allows Reflected XSS. This issue affects Make Email Customizer for WooCommerce: from n/a through 1.0.5.

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Apr 17, 2025

CVE-2025-32511 on NVD →

The Make Email Customizer for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 1.0.5

Fix:

No patched version reported

Disclosed:

Apr 10, 2025

CVE-2025-32511 on NVD →