High · 7.2 CVE-2026-94677 EUVD-2026-89849GHSA-jppp-m2g8-7jvx

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: Nexcess Product: Kadence WooCommerce Email Designer Category: Web / CMS

Description

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Affected products

Vendor	Product	Affected	Fixed
Nexcess	Kadence WooCommerce Email Designer	≤ 1.5.19.1	—

References

https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-19-1-php-object-injection-vulnerability?_s_id=cve vdb-entry