Woo Email Control
Woo Email Control has one disclosed vulnerability in the WordSec catalog, all reported in 2016; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Woo Email Control has a vendor fix available, so running the current release closes it.
All of these findings were reported by rastating. Woo Email Control is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.5.33.
Woo Email Control < 1.02 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

Woo Email Control
Author
findshorty
This enhancement to the Woocommerce email system allows you to get more control of your Woocommerce emails. Add product images of any size – (requires Woocommerce 2.6+) Embed and attach email images Easier selection of email header image (replaces the Woocommerce default functionality) Display product categories for each line item Display product SKU for each line item Test your emails either in your browser or emailed to your email address using data from real orders It is compatible with either the standard email templates, or your custom templates, as long as you retain the correct hooks and filters used by the standard templates. The plugin also gives you the option of attaching and embedding any images within the email, including the header image if you have chosen one. This prevents the user having to “load images” when they receive the email, reduces the chances of your emails being considered as spam with most providers, and prevents your images becoming “not found” if the user or your website are offline. Be careful not to overuse large embedded images as it does increase the size of your emails. Woo Email Control also provides a very useful testing facility, whereby you can either view any email directly within the browser, or send it to your email address. The preview emails contain live data for any order, not simply the empty template – great for checking your custom email templates without having to create or edit a new test order each time. Please note This is an Add-on for Woocommerce and requires Woocommerce 2.5+ (2.6+ for product images)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C