What is the CVSS score of CVE-2026-10091?

CVE-2026-10091 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Email JavaScript Cloak are affected by CVE-2026-10091?

The Email JavaScript Cloak WordPress plugin (versions 1.03 and earlier) contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript.

How to fix or mitigate CVE-2026-10091?

Within 24 hours: Identify all installations of Email JavaScript Cloak ≤1.03; audit all pages using this plugin for suspicious shortcode attributes; review activity logs for all contributor-level accounts. Within 7 days: Disable the vulnerable plugin entirely; implement Web Application Firewall rules blocking XSS patterns in shortcode parameters; contact vendor for patch timeline. Within 30 days: Scan all historical contributions from the past 90 days for injected malicious code; restrict contributor role access to essential staff only; evaluate alternative email security plugins.

Email JavaScript Cloak CVE-2026-10091

EUVD-2026-38657 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-j79v-p5cw-7gp5

WordPress XSS Wordpress Plugin Email Javascript Cloak

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable shortcode but contributor account required (PR:L) and a victim must load the rendered page (UI:R); scope changes to victim browser with limited C/I impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:55 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.2

DescriptionCVE.org

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' shortcode in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Articles & Coverage 2

medium.com CVE-2026-10091: Stored XSS via Shortcode in Email JavaScript Cloak WordPress Plugin Jul 04, 2026 News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Stored cross-site scripting in the Email JavaScript Cloak WordPress plugin (versions ≤1.03) allows authenticated contributors and higher to inject arbitrary JavaScript via unsanitized attributes of the plugin's 'email' shortcode. The payload executes in any visitor's browser that renders the affected page, enabling session theft or site defacement. No public exploit identified at time of analysis, and the plugin is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the email-javascript-cloaker plugin (CPE cgarvey:email_javascript_cloak), a small WordPress add-on that obfuscates email addresses using JavaScript to deter scrapers. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: the shortcode handler in email-js-cloak.php (referenced at lines 45 and 68 in the WordPress plugin trac) accepts user-controlled attributes and emits them into the rendered page without applying esc_attr(), wp_kses(), or comparable output-escaping primitives, so attacker-controlled markup is reflected into the DOM as live HTML.

RemediationAI

No vendor-released patch identified at time of analysis - version 1.03 remains the latest published release on the WordPress plugin repository. As compensating controls, deactivate and remove the Email JavaScript Cloak plugin (the email-cloaking functionality can be replaced with server-side address obfuscation or alternative maintained plugins, with the trade-off of changing how email links render); alternatively, restrict the contributor role from using the 'email' shortcode via a capability-management plugin or a WAF rule that strips or sanitizes the shortcode's attributes (this breaks legitimate use of the shortcode for those roles). Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/16ded5aa-c8e8-4d98-b07f-e689ad0e03c7?source=cve for a fixed version.