Email Attachment by Order Status & Products
Email Attachment by Order Status & Products has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Email Attachment by Order Status & Products has a vendor fix available, so running the current release closes it.
All of these findings were reported by Martino Spagnuolo. Email Attachment by Order Status & Products is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-49957Email Attachment by Order Status & Products <= 1.0.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Email Attachment by Order Status & Products
Author
Weboccult Technologies Pvt Ltd
Email Attachment by Order Status & Products allow admin to send custom attachment to their customers when woocommerce status change notification email triggered It provide admin facility to send product related information to their users after placed order like product manual or how to use product. It also useful for booking type product to send pdf or document to users to provide accommodation and rules about their booking. FEATURES It allows admin to add one more attachment for order status. It allows admin to add attachment by product type. It allows admin to add attachment to single or multiple products. It allow to add attachment by different languages when WPML is active. STEPS TO USE You have to add one or more attachment and order status you want to send attachment. You can select product type or single product or multiple product option to add attachment for your specific need. Upload attachment from media library
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C