What is the CVSS score of CVE-2026-5306?

CVE-2026-5306 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-5306?

Yes, a public proof-of-concept exploit is available for CVE-2026-5306. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-5306?

Yes, a patch is available for CVE-2026-5306. Update the affected software to the latest version immediately.

Check & Log Email CVE-2026-5306

EUVD-2026-25995 MEDIUM

2026-04-28 WPScan

WordPress XSS Check Log Email Unknown

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 28, 2026 - 20:13 vuln.today

Public exploit code

Patch released

Apr 28, 2026 - 20:13 nvd

Patch available

Analysis Generated

Apr 28, 2026 - 15:24 vuln.today

CVSS changed

Apr 28, 2026 - 15:22 NVD

5.4 (MEDIUM)

Patch available

Apr 28, 2026 - 08:01 EUVD

EUVD ID Assigned

Apr 28, 2026 - 06:30 euvd

EUVD-2026-25995

Analysis Generated

Apr 28, 2026 - 06:30 vuln.today

CVE Published

Apr 28, 2026 - 06:00 nvd

MEDIUM 5.4

DescriptionCVE.org

The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled

AnalysisAI

Stored XSS vulnerability in Check & Log Email WordPress plugin before version 2.0.13 allows authenticated users with low privileges to inject malicious scripts via improper email replacement handling when the email encoder setting is enabled. The vulnerability requires user interaction (UI:R) to execute, affecting confidentiality and integrity with cross-site scope. Publicly available exploit code exists but exploitation probability remains low (EPSS 0.05%, percentile 17%), indicating this is not a widely targeted vulnerability despite public awareness.

Technical ContextAI

The vulnerability stems from insufficient input sanitization in the email replacement functionality of the Check & Log Email WordPress plugin. When the email encoder setting is activated, the plugin fails to properly validate or escape email addresses and related data before storing them in the database, enabling attackers to inject arbitrary HTML and JavaScript. The cross-site scope (S:C) in the CVSS vector indicates the vulnerability can affect other users or contexts beyond the immediate attack target. This is a classic stored XSS weakness (CWE category: improper neutralization of input during web page generation) affecting the WordPress plugin ecosystem.

RemediationAI

Update the Check & Log Email WordPress plugin to version 2.0.13 or later, which contains vendor-released patches addressing the email replacement sanitization issue. This is the primary and complete remediation. For organizations unable to immediately patch, disable the email encoder setting in plugin configuration, which eliminates the attack surface entirely and eliminates the vulnerability's prerequisite condition. No workarounds exist that maintain full functionality while accepting exploitability risk. Verify the update through the WordPress plugin dashboard or manually confirm version 2.0.13 or higher is installed post-update.