Check & Log Email CVE-2026-5306

EUVD-2026-25995 MEDIUM

2026-04-28 WPScan

WordPress XSS

5.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 15:24 vuln.today

CVSS changed

Apr 28, 2026 - 15:22 NVD

5.4 (MEDIUM)

Patch available

Apr 28, 2026 - 08:01 EUVD

DescriptionNVD

The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled

AnalysisAI

Stored XSS vulnerability in Check & Log Email WordPress plugin before version 2.0.13 allows authenticated users with low privileges to inject malicious scripts via improper email replacement handling when the email encoder setting is enabled. The vulnerability requires user interaction (UI:R) to execute, affecting confidentiality and integrity with cross-site scope. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-3844 CRITICAL Act Now

9.8 Apr 23

Arbitrary file upload in Breeze Cache for WordPress allows unauthenticated remote attackers to upload malicious files an

CVE-2026-4106 MEDIUM This Month POC

5.3 Apr 23

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some P

CVE-2026-7106 HIGH This Week

8.8 Apr 27

Authenticated attackers with Subscriber-level privileges can escalate to Administrator role in Highland Software Custom

CVE-2026-6741 HIGH This Week

8.8 Apr 27

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Esca

CVE-2026-5364 HIGH This Week

8.1 Apr 24

Remote code execution in Drag and Drop File Upload for Contact Form 7 plugin (≤1.1.3) allows unauthenticated attackers t

CVE-2026-5306 vulnerability details – vuln.today

Back