EUVD-2026-25995Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
8DescriptionCVE.org
The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled
AnalysisAI
Stored XSS vulnerability in Check & Log Email WordPress plugin before version 2.0.13 allows authenticated users with low privileges to inject malicious scripts via improper email replacement handling when the email encoder setting is enabled. The vulnerability requires user interaction (UI:R) to execute, affecting confidentiality and integrity with cross-site scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions: (1) The Check & Log Email plugin must be installed and activated on the WordPress instance, (2) the email encoder setting must be explicitly enabled in plugin configuration, (3) the attacker must possess authenticated WordPress user access at contributor level or above to create or modify email log entries that are viewed by higher-privileged users (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents a moderate but nuanced risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated WordPress user with low privileges (e.g., contributor or subscriber account) enables or leverages the email encoder plugin setting, then crafts a malicious email address or replacement rule containing embedded JavaScript (e.g., <script>alert('XSS')</script> in place of email placeholders). When an administrator or other user views the logged email data in the WordPress dashboard, the unescaped script executes in their browser context, potentially stealing session cookies or redirecting them to a phishing site. … |
| Remediation | Update the Check & Log Email WordPress plugin to version 2.0.13 or later, which contains vendor-released patches addressing the email replacement sanitization issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticat
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows un
Share
External POC / Exploit Code
Leaving vuln.today