EUVD-2026-23229
GHSA-6f47-h5cp-7cwm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS canonically requires victim page-load (UI:R); all other metrics align with the description - contributor auth (PR:L), network delivery (AV:N), cross-user scope change (S:C), no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Email Encoder - Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Email Encoder - Protect Email Addresses and Phone Numbers WordPress plugin (versions ≤ 2.4.4) allows authenticated contributors to inject persistent JavaScript via the 'eeb_mailto' shortcode due to missing sanitization in MailtoShortcode.php. When any user visits a page containing the poisoned shortcode, the injected script executes in their browser, enabling session hijack, credential theft, or admin account takeover. EPSS sits at 0.03% (8th percentile) and CISA SSVC records exploitation as none, placing current real-world risk low despite the scope-changed CVSS of 6.4.
Technical ContextAI
The affected product is the 'email-encoder-bundle' WordPress plugin by onlineoptimisation (CPE: cpe:2.3:a:onlineoptimisation:email_encoder_-_protect_email_addresses_and_phone_numbers:*:*:*:*:*:*:*:*), designed to obfuscate email addresses and phone numbers from harvesting bots via shortcodes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the 'eeb_mailto' shortcode handler - the MailtoShortcode.php and Encoding.php files in versions ≤ 2.4.4 failed to sanitize shortcode attributes before storage and failed to escape them on output. WordPress contributors have permission to insert shortcodes into posts and pages, making this attack surface reachable by low-privileged users. The CVSS scope change (S:C) reflects the browser-side impact extending beyond the WordPress installation itself to visiting users' security contexts.
RemediationAI
Upgrade the Email Encoder plugin to version 2.4.5 or later immediately; the patch is confirmed via WordPress Trac changesets (https://plugins.trac.wordpress.org/changeset comparing tags/2.4.4 to tags/2.4.5) and addresses insufficient sanitization in both MailtoShortcode.php and Encoding.php. For sites that cannot patch immediately, restrict contributor-level account creation and audit existing contributor accounts for unauthorized additions, as the attack requires that privilege level. Disabling the 'eeb_mailto' shortcode via a content security policy or a shortcode-blocking plugin removes the vulnerable attack surface without disabling the whole plugin, though this trades email obfuscation functionality. A strict Content-Security-Policy header disallowing inline scripts will limit the impact of any residual stored XSS payloads. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9987b5b4-33d8-4446-acbe-58c6cb5604df) provides additional guidance.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today