Kadence WooCommerce Email Designer

Kadence WooCommerce Email Designer has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 7 are fixed as of October 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (29%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 7 issues recorded for Kadence WooCommerce Email Designer has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Kadence WooCommerce Email Designer vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-28005

Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

7 records


2026-09-24 00:00	Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection Kadence WooCommerce Email Designer <= 1.5.19.1	`CVE-2026-94677`	6.6 Medium	Ananda Dhakal	Yes
2026-08-04 00:00	Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation Kadence WooCommerce Email Designer <= 1.5.19	`CVE-2026-28005`	9.8 Critical	daroo	Yes
2025-12-01 16:23	Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting Kadence WooCommerce Email Designer <= 1.5.17	`CVE-2025-13387`	7.2 High	shark3y	Yes
2025-08-14 00:00	Kadence WooCommerce Email Designer <= 1.5.16 - Authenticated (Shop Manager+) Arbitrary Options Update Kadence WooCommerce Email Designer <= 1.5.16	`CVE-2025-54697`	7.2 High	Denver Jackson	Yes
2025-04-16 00:00	Kadence WooCommerce Email Designer <= 1.5.14 - Authenticated (Admin+) Arbitrary File Upload Kadence WooCommerce Email Designer <= 1.5.14	`CVE-2025-39557`	7.2 High	Phan Trong Quan	Yes
2023-11-02 00:00	Kadence WooCommerce Email Designer <= 1.5.11 - Cross-Site Request Forgery Kadence WooCommerce Email Designer <= 1.5.11	`CVE-2023-47186`	4.3 Medium	Brandon James Roldan (tomorrowisnew)	Yes
2022-09-30 00:00	Kadence WooCommerce Email Designer <= 1.5.6 - PHP Object Injection Kadence WooCommerce Email Designer <= 1.5.6	`CVE-2022-3335`	7.2 High	Nguyen Duy Quoc Khanh	Yes

Showing 1–7 of 7 reports