EUVD-2026-31068
GHSA-hmgx-5p26-ccf2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
AnalysisAI
Stored XSS in the Email Encoder WordPress plugin (all versions before 2.4.7) permits unauthenticated remote attackers to inject persistent malicious scripts by supplying unsanitized email addresses through public-facing input fields. Because the CVSS scope is Changed (S:C), injected payloads execute in victim browsers rather than the server context, enabling session hijacking, credential theft, or malicious redirects against any visitor who loads an affected page. A publicly available proof-of-concept exists per WPScan reporting; no public exploit identified at time of analysis as actively exploited via CISA KEV.
Technical ContextAI
The Email Encoder plugin (CPE: cpe:2.3:a:unknown:email_encoder:*:*:*:*:*:*:*:*) is a WordPress plugin designed to obfuscate or encode email addresses on websites to deter harvesting bots. The root cause is a failure to HTML-escape user-supplied email address values before persisting and rendering them - a textbook Stored Cross-Site Scripting defect (CWE field is listed as N/A in available data, but the vulnerability class is clearly CWE-79). Unlike Reflected XSS, stored variants persist in the database and activate on every subsequent page load for any visitor, multiplying exposure. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C confirms network reachability with no complexity or privilege barrier, though victim browser interaction (page load) is required to trigger payload execution. The changed scope component indicates the injected script runs in the victim browser's security context, separate from the WordPress server processing the original request.
RemediationAI
Upgrade the Email Encoder WordPress plugin to version 2.4.7 or later, which introduces proper output escaping for user-supplied email address values. The vendor-released patch is confirmed available per EUVD-2026-31068 and the WPScan advisory at https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/. Updates can be applied directly through the WordPress admin dashboard under Plugins > Installed Plugins > Update. If immediate patching is not feasible, disable or remove the Email Encoder plugin entirely until the update can be applied, eliminating the attack surface; note this will remove email obfuscation functionality from the site. Deploying a WAF rule targeting script injection patterns in email input fields (e.g., blocking angle brackets and script tags in form submissions) provides partial compensating control but carries a false-positive risk for legitimate inputs and should not substitute patching. No additional workaround short of plugin removal or patching is sufficient given the zero-authentication attack vector.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Share
External POC / Exploit Code
Leaving vuln.today