CVE-2026-103358

{
  "etk_id": "ETK-2026-1870",
  "cve_id": "CVE-2026-103358",
  "display_id": "CVE-2026-103358",
  "ghsa_id": "GHSA-fqh3-49hp-8c6j",
  "euvd_id": "EUVD-2026-100987",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Code injection in Email Template Customizer for WooCommerce",
  "summary": "Email Template Customizer for WooCommerce versions through 1.3.4 are affected by a code-injection flaw. An unauthenticated remote attacker may be able to inject code when an affected plugin installation is reachable.",
  "mitigation": "Disable the affected plugin on sites using version 1.3.4 or earlier until VillaTheme provides an updated release. Restrict public reachability of affected WordPress sites where disabling the plugin is not immediately possible.",
  "vendor": "VillaTheme",
  "product": "Email Template Customizer for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.3.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "email-template-customizer-for-woo",
      "purl": null
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0032,
  "epss_percentile": 0.2381,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 49.73655775,
  "t0_at": "2026-10-14T11:00:11.345000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T10:51:27.087873+00:00",
      "days": 2.9939322091782405,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T11:00:11.345000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-14T11:00:11.345000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T11:00:11.345000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103358"
    }
  }
}