CVE-2022-0218: WP HTML Mail plugin missing authorization enables unauthenticated stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated access to a settings endpoint that permits stored script injection is serious, and the very high EPSS score plus an exploit-tagged advisory indicate likely active interest.

What it is

The WP HTML Mail WordPress plugin exposes the /themesettings REST-API endpoint without a capability check in includes/class-template-designer.php, affecting versions up to and including 3.0.9. Unauthenticated attackers can read and modify theme settings, and the description states they can inject malicious JavaScript into the site. The flaw combines missing authorization (CWE-862) with cross-site scripting (CWE-79).

Impact

An attacker can change theme settings and plant malicious JavaScript that executes in the browser of site visitors or administrators. This enables session theft, credential capture, or arbitrary actions in the context of a victim's session.

Attack surface

Reachable over the network through the plugin's REST-API endpoint; no authentication is required per the description and CVSS vector (PR:N). The CVSS vector includes UI:R, so some user interaction is needed for the script to execute in a victim's browser.

Exploitation

Not listed in CISA KEV, but EPSS is 0.70511 (99.357th percentile), indicating high predicted exploitation activity. References include an Exploit-tagged Wordfence advisory, so public exploitation details exist.

What to do

• Update WP HTML Mail to a version newer than 3.0.9, which contains the patch referenced in the plugin changeset.
• If immediate patching is not possible, disable or remove the WP HTML Mail plugin until it can be updated.
• Restrict access to the WordPress REST API where feasible, and review any custom rules that expose plugin endpoints to unauthenticated users.
• Audit theme settings and templates for injected JavaScript or unexpected modifications, and restore from a known-good backup if tampering is found.
• Apply a web application firewall rule to block unauthenticated requests to the plugin's /themesettings endpoint.

Detection

• Monitor web server and WordPress logs for unauthenticated requests to the WP HTML Mail /themesettings REST-API endpoint.
• Inspect stored theme settings and email templates for unexpected script tags or JavaScript content.
• Review WordPress user and plugin activity logs for changes to WP HTML Mail settings made outside normal administrative sessions.
• Hunt for outbound or inline script content in rendered pages that references unexpected external domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.