VillaTheme Email Template Customizer for WooCommerce: Code injection
Summary
Email Template Customizer for WooCommerce, a WordPress plugin by VillaTheme, contains a code injection vulnerability (CWE-94) in versions up to and including 1.3.4. According to the CNA vector, an unauthenticated attacker over the network could inject content that is then processed, potentially allowing unwanted content such as ads, scam or malware links on the site. The exact preconditions and the vulnerable function could not be verified from the advisory.
Affected
- Email Template Customizer for WooCommerce (WordPress slug email-template-customizer-for-woo) up to and including 1.3.4
- Other databases list affected versions as >=0 <1.3.5
- Note: the plugin was previously sold as Mailonix under the same name; verify which version is installed
Fixed in
- Patchstack and the CVE record indicate a fix in version 1.3.5 or later
- A third-party reseller shows version 1.4.2; this could not be confirmed as a fix
Workaround
- None found. No vendor-stated workaround is known.
Exploitation
- No evidence of exploitation in the wild; not listed in KEV
- No public proof of concept found
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- EPSS 0.00322 (low)
Our recommendation
- Identify all WordPress sites running this plugin, especially internet-facing WooCommerce shops
- Update to version 1.3.5 or later, or to the latest vendor release after verifying it contains the fix
- If no update is possible, deactivate and remove the plugin if email customisation is not business-critical
- Restrict WordPress admin and plugin management access
- If a web application firewall with virtual patching is used, ask the provider whether it covers this advisory
- Check customer-facing emails and site pages for unexpected content and monitor logs
- Re-check the advisory and NVD entry, as the NVD status is still deferred
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Patchstack vulnerability database for the plugin patchstack.com
- VulDB entry vuldb.com
- Strix AI CVE record www.strix.ai
- VulnRichment (Vulners) vulners.com
- OffSeq Radar entry radar.offseq.com
- CVE List V5 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 17:01.
Original description (NVD)
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.