Email Marketing for WooCommerce by Omnisend
Email Marketing for WooCommerce by Omnisend has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.
Every one of the 4 issues recorded for Email Marketing for WooCommerce by Omnisend has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Email Marketing for WooCommerce by Omnisend is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-42668Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token
Read the full analysisVulnerability Records

Email Marketing for WooCommerce by Omnisend
Author
Omnisend
POWERFUL, YET INTUITIVE EMAIL MARKETING, NEWSLETTER, SMS MARKETING & AUTOMATION PLUGIN FOR WOOCOMMERCE Omnisend is an email & SMS marketing plugin for WooCommerce, used by more than 150,000 ecommerce brands worldwide. Build your email and SMS lists, send targeted campaigns, create automation workflows, and see what each one earned — all from within your WordPress dashboard. Built-in AI writes your copy and builds your segments on every plan, and with Omnisend MCP, your ChatGPT or Claude can do the same from a chat window. Free to start, no credit card needed. Some of the features of Omnisend include: 🎉 All-in-one email & SMS marketing solution Create and send email and SMS campaigns to targeted audiences, onboard new customers with sequential emails, and automate your marketing in a visual workflow builder. Automations are roughly 2% of all email sends but drive close to a third of email revenue, so the pre-built flows are the fastest thing to switch on. Once a campaign goes out, you get reports on open rate, click rate, and the sales that campaign generated. You can see who opened and who clicked, then segment further on that behavior. 📧📱 Email & SMS Campaigns Build email & SMS campaigns in a drag-and-drop editor, with 250+ ecommerce templates to start from Use dynamic content to personalize the experience for your customers Import your store’s branding (logos, colors, and fonts) into your emails and popups automatically with Brand Assets AI Send or schedule emails and SMS for a future date and time, and track your results in real time Segment and target campaigns on behavior, demographics, purchase history, and more Set up campaigns that trigger on customer behavior: welcome new subscribers, recover abandoned carts, upsell and cross-sell Resend to non-openers with a fresh subject line using Campaign Booster Test different subject lines, content, and designs to see what works best for your audience Get detailed reporting on how many people opened, clicked, and converted from your emails ⚙️ Automation workflows Build powerful automation workflows in a visual builder, no code needed Automate everything from welcome emails to abandoned cart reminders and win-back campaigns Trigger workflows on user actions like sign-up, form submission, purchase, or inactivity Measure metrics at every step and find where you can do better Combine email, SMS, and push notifications in a single workflow Sync your email and SMS audiences with Facebook Custom Audiences and Google Ads Create advanced journeys with split paths, delays, and conditional logic in one automation Use dynamic content to show different product recommendations, pricing, and messaging to different segments 📱 SMS marketing Set up automated SMS campaigns for order confirmations, shipping updates, and promotions, from $0.007 per message Segment and target SMS on behavior, purchase history, and lifecycle stage Use customizable opt-in forms to collect phone numbers and consent to send SMS messages Stay compliant by default with frequency capping, localized quiet hours, and TCPA-friendly forms 📝 Integrated opt-in forms Create popups, flyouts, embedded forms, and landing pages right from Omnisend Describe the form you want and Forms AI Assistant builds the layout, copy, and design (paid plans) Use forms as automation triggers, and segment contacts by which form they filled out 📊 Built-in analytics & dashboards View your business insights from the Omnisend dashboard with graphs, charts, and data widgets Track revenue attribution by campaign, automation, and channel, with 18 months of history on Pro 🤖 Omnisend AI — on every plan, free included Generate email copy, subject lines, and preheaders in your brand’s voice Get suggestions for grammar, tone, and style while you edit Describe an audience in plain words and AI builds the segment for you Recommend the right products for each shopper using browsing and purchase history Adapt one campaign to different customer types — no need to create multiples Group customers by recency, frequency, and spend with Customer Breakdown Spot who’s about to churn and who your highest-value shoppers are 🧠 Omnisend MCP: connect ChatGPT or Claude Connect Omnisend to ChatGPT or Claude, then manage it right from the chat you already use Build segments and draft campaigns straight from the conversation Ask how your campaigns performed, which automations earned the most, and why a number moved 🛒 Ecommerce integrations Integrations: Omnisend works with 250+ ecommerce tools, including Gorgias, Yotpo, Zapier, and ShipStation Real-time sync: Customer, order, and product data updates instantly, so your segments are never stale Facebook and Google Ads sync: Send contact data over to build targeted lookalike audiences Ecommerce reporting: See how much revenue you generated and what’s actually selling ✨ Even more features Turn your website visitors into subscribers with website signup forms Web push notifications to reach everyone online who opted in Double opt-in for better list quality Spot contacts going quiet and adjust your email and SMS before they’re gone 🔒 Fully GDPR ready Omnisend is a self-hosted WordPress plugin. You own your data, and it’s protected with current security standards. Our plugin is fully GDPR compliant, so you can be confident your customers’ data is collected and used responsibly. 🎧 Free 24/7 support, in 6 languages Live chat and email support on every plan, including free, in English, German, Italian, Spanish, French, and Simplified Chinese. From $400/month you also get a dedicated Account Expert. And there’s a Help Center for when you’d rather sort it out yourself. 🚀 Drive engagement with Omnisend Omnisend is an email and SMS marketing automation plugin built for ecommerce from day one. Founded in 2014 as Soundest, it came from a simple observation: mid-sized merchants had the data to personalize, but not the affordable tools. From day one, we put ecommerce marketers at the center of every decision we’d make — and that hasn’t changed at all. Join thousands of happy customers and start driving engagement with Omnisend today. Here’s what our customers are saying about us: ★★★★★ “Very great functionality that makes my WooCommerce business grow rapidly. The support is outstanding, and they always do their best to solve everything I need.” ★★★★★ “Omnisend is excellent for a very beginner. It’s so easy to use but if you do not understand something, customer service is always ready to help. There is a chat icon on every page, and they answer just some minutes after the question. I feel very encouraged even if is my very first experience with such a service.” ★★★★★ “I manage multiple stores with different providers, mostly were mailchimp, well after trying omnisend (especially with big data stores) I decided to switch multiple big stores (over 100k orders); the decision was easy to make as the sync process on mailchimp, it took a week! Here it took 3 hours! That is just the biggest leap for me as mailchimp would randomly disconnect the store or cancel automations without notice (multiple accounts). Using omnisend on almost 10 stores for 4 months and everything is great! The interface, automations and support are very good, I strongly recommend them for stores who need data statistics and segmentation (grouping) on their audience (lists), who need fast automations, great, reliable and fast support. P.S. Their API has responses and it’s pretty well documented, I’ve made a few implementations and everything looks great!” ★★★★★ “We have been using Omnisend for some time now and their interface is easy and intuitive and integrating with our other systems and apps has been seamless. If ever we have a question they are quick to answer and are always helpful. A big shout out to both Agustine and Stefan they are a credit to your team 🙂” WPBeginner talks about us in this video: Omnisend Email & SMS marketing reviews by other experts: WooCommerce integration: Omnisend installs as a WooCommerce plugin, so you can skip the third-party connector and the developer time that usually comes with it. Customer, order, and product data lands in your account in real time, which means you can segment contacts on purchase history, items bought, total spend, how recently they ordered, and send campaigns that match – abandoned cart reminders, post-purchase follow-ups, and replenishment. Product blocks pull live prices and stock from your catalog, so you’re never updating an email by hand. Form integration: Add Omnisend’s signup forms to your WordPress site with a few clicks and automatically add new subscribers to your Omnisend account. You can also segment your email marketing and SMS subscribers based on the form they filled out or the page they signed up from. Great user experience: The plugin has a clean interface that lets you create and manage email and SMS campaigns directly from your WordPress dashboard, with 24/7 live chat if you get stuck. Ads integrations: Drive more traffic to your store with improved targeting and reporting. Facebook Lead Ads Facebook Custom Audiences Google Ads Customer Match Facebook Auto-Post Campaigns Amazon Attribution PageFly Landing Page Builder Reelevant GemPages Quizell Postcard Marketing Automation Subscription integrations: Send targeted campaigns and trigger automated messages based on contact subscription status and activity. Recharge Owids Glew.io Govalo Subscriptions by Loop Getsitecontrol Reviews integrations: Show your customers you care about them by following up on their reviews. Judge.me Yotpo Product Reviews Loox Product Reviews & Photos Stamped.io Reviews, Ratings & Loyalty Growave ‑ Loyalty, Wishlist, Reviews Junip – Product Reviews & UGC Reviews and Customer Platform Opinew Product Reviews Reviews.io: Product Reviews POWR UGC Galleries Fera Vitals: All-in-One Marketing Loyalty & Rewards integrations: Discover apps that’ll help you turn one-time customers into repeat customers. Smile Loyalty Lion Happy Birthday Discount Gameball Stamped.io Reviews, Ratings & Loyalty Yotpo Loyalty & Referrals ReConvert Upsell & Cross-Sell Growave ‑ Loyalty, Wishlist, Reviews ONE: Popups, SMS & Email Marketing 99minds – Gift Card, Loyalty & Promotion UpViral Lateshipment – Automate Post-Purchase Emails Goaffpro Affiliate Marketing Conjured Referrals Lootly Audmate Giveaway Ninja Affiliate & Influencer marketing integrations: Use influencer marketing and affiliate data to make your workflows more relevant. Gatsby GrowthHero – Partner Marketing Goaffpro Affiliate Marketing Conjured Referrals UpPromote: Affiliate Marketing Webplanex Cashback Rewards Giveaway Ninja Automations & Middleware integrations: Set up and customize automations between Omnisend and your favorite apps. MESA – Workflow Automation Zapier Make Alloy Integrately GemPages Tresl – Segments Supermetrics Glew.io Appy Pie Connect SyncSpider Argoid Upsell Cross‑sell Engine Shipping & Logistics integrations: Keep your customers up-to-date about their order status and shipping information. AfterShip ShipStation Easyship MultiParcels Rush – Order Tracking & Lookup Sufio ParcelPanel Order Tracking Lateshipment – Automate Post-Purchase Emails WeSupply – Track Order, Lookup & Returns TrackingMore Tracktor Loop Exchanges and Returns Customer support integrations: Apps to help you keep your brand top of mind. Gorgias Re:amaze Intercom Sufio PageFly Landing Page Builder Attentive Contact Form Builder Tidio ‑ Live Chat & Chatbots Back-in-stock & wishlist integrations: Build workflows based on back-in-stock items and your contact’s wishlists. Swym Back In Stock – Restock Alerts Wishlist Hero Notify Me! Back in Stock Alerts Free 5-day migration from Mailchimp, Klaviyo, and more Switching is the part everyone dreads, so we do it for you. Give us access and our team rebuilds every list, flow, and template within five days, free — abandoned cart, post-purchase, win-back, and your custom ones. Covers Klaviyo, Mailchimp, ConvertKit, MailerLite, Drip and ActiveCampaign. Prefer to do it yourself? Omnisend has made migration from other ESPs or CRMs — like Mailchimp and Klaviyo — a seamless experience, thanks to our dedicated migration tools. That’s right, just a few clicks and a few minutes, and you’ll get your data imported into Omnisend. Switch now from Klaviyo, Mailchimp, ConvertKit, MailerLite, Drip and Active Campaign in just minutes.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C