Check & Log Email EUVD-2026-25995

Exploitation requires three specific conditions: (1) The Check & Log Email plugin must be installed and activated on the WordPress instance, (2) the email encoder setting must be explicitly enabled in plugin configuration, (3) the attacker must possess authenticated WordPress user access at contributor level or above to create or modify email log entries that are viewed by higher-privileged users (PR:L). The vulnerability does NOT affect installations where the email encoder feature is disabled, making non-default configuration a significant limiting factor. Stored XSS also requires a second user to view the malicious payload, introducing user interaction dependency that prevents full automation.

This vulnerability presents a moderate but nuanced risk profile. While the CVSS score of 5.4 is in the medium range, multiple risk signals suggest lower real-world priority: EPSS score of 0.05% (percentile 17%) indicates very low likelihood of exploitation in the wild, contradicting typical medium-CVSS assumptions. The vulnerability requires authenticated access (PR:L), eliminating remote unauthenticated exploitation pathways. User interaction (UI:R) is mandatory, further reducing automation potential. The presence of publicly available exploit code increases awareness among attackers, yet the low EPSS suggests actual exploitation remains rare or targeted. Organizations with the email encoder setting disabled face no risk. This is appropriately a lower-priority vulnerability for most WordPress deployments despite public disclosure, unless the affected plugin is actively used in a high-value application.

An authenticated WordPress user with low privileges (e.g., contributor or subscriber account) enables or leverages the email encoder plugin setting, then crafts a malicious email address or replacement rule containing embedded JavaScript (e.g., <script>alert('XSS')</script> in place of email placeholders). When an administrator or other user views the logged email data in the WordPress dashboard, the unescaped script executes in their browser context, potentially stealing session cookies or redirecting them to a phishing site. Publicly available exploit code exists to demonstrate this vector.