Email Address Encoder CVE-2026-5305

Exploitation requires the vulnerable Email Address Encoder (<1.0.25) or Email Encoder Premium (<0.3.12) plugin to be installed and active, and the attacker must reach an input path that flows into the plugin's email-replacement routine to plant the stored payload. Injection itself needs no authentication (PR:N), but payload execution is gated by user interaction (UI:R) - a victim, typically a logged-in administrator or visitor, must subsequently render the page containing the stored script for impact to occur. The limiting factors that reduce realistic risk are this required victim interaction and the requirement that the specific plugin be deployed; there is no impact on sites not running these plugins or already on the patched versions.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) rates this High/Critical, but the C:H/I:H/A:H impact is aggressive for a Stored XSS where script runs in a victim's browser rather than directly compromising the server - a more defensible assessment is S:C with low confidentiality/integrity impact (see assessed vector). Real-world signals are mixed: PR:N makes injection trivial and unauthenticated, but UI:R means a privileged user must view the poisoned content for impact to materialize, so this is not a fully autonomous network exploit. POC availability and a WPScan disclosure raise practical risk, yet the absence of KEV listing and the dependency on victim interaction suggest opportunistic rather than confirmed mass exploitation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be cited; no SSVC decision data was supplied either. Net: a genuine priority for sites running these plugins given the public POC and easy injection, but the headline 8.8 likely overstates technical impact for an XSS.

An unauthenticated attacker submits content containing a crafted payload that the plugin's email-replacement logic stores without proper neutralization; the script lies dormant in the database. When a site administrator or other user later views the page, the JavaScript executes in their browser session, enabling session/cookie theft or admin-action forgery. Public exploit code from WPScan lowers the skill required, and the low attack complexity (AC:L) makes the injection reliable, though impact depends on a victim rendering the page (UI:R).