CVE-2026-57416

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The SiteGround Email Marketing plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.7.5.

Risk Assessment

An attacker can inject malicious JavaScript that executes in the browsers of administrators and users, potentially leading to session theft, account takeover, or website defacement.

Recommendation

Immediately update the SiteGround Email Marketing plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in SiteGround Email Marketing

CVE-2025-62912Medium
The SiteGround Email Marketing plugin (versions up to 1.7.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS