EUVD-2026-31068
GHSA-hmgx-5p26-ccf2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
AnalysisAI
Stored XSS in the Email Encoder WordPress plugin (all versions before 2.4.7) permits unauthenticated remote attackers to inject persistent malicious scripts by supplying unsanitized email addresses through public-facing input fields. Because the CVSS scope is Changed (S:C), injected payloads execute in victim browsers rather than the server context, enabling session hijacking, credential theft, or malicious redirects against any visitor who loads an affected page. A publicly available proof-of-concept exists per WPScan reporting; no public exploit identified at time of analysis as actively exploited via CISA KEV.
Technical ContextAI
The Email Encoder plugin (CPE: cpe:2.3:a:unknown:email_encoder:*:*:*:*:*:*:*:*) is a WordPress plugin designed to obfuscate or encode email addresses on websites to deter harvesting bots. The root cause is a failure to HTML-escape user-supplied email address values before persisting and rendering them - a textbook Stored Cross-Site Scripting defect (CWE field is listed as N/A in available data, but the vulnerability class is clearly CWE-79). Unlike Reflected XSS, stored variants persist in the database and activate on every subsequent page load for any visitor, multiplying exposure. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C confirms network reachability with no complexity or privilege barrier, though victim browser interaction (page load) is required to trigger payload execution. The changed scope component indicates the injected script runs in the victim browser's security context, separate from the WordPress server processing the original request.
RemediationAI
Upgrade the Email Encoder WordPress plugin to version 2.4.7 or later, which introduces proper output escaping for user-supplied email address values. The vendor-released patch is confirmed available per EUVD-2026-31068 and the WPScan advisory at https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/. Updates can be applied directly through the WordPress admin dashboard under Plugins > Installed Plugins > Update. If immediate patching is not feasible, disable or remove the Email Encoder plugin entirely until the update can be applied, eliminating the attack surface; note this will remove email obfuscation functionality from the site. Deploying a WAF rule targeting script injection patterns in email input fields (e.g., blocking angle brackets and script tags in form submissions) provides partial compensating control but carries a false-positive risk for legitimate inputs and should not substitute patching. No additional workaround short of plugin removal or patching is sufficient given the zero-authentication attack vector.
More in Email Encoder
View allThe Email Encoder - Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authenticatio
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Em
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] par
The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow hig
The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in ve
The Email Encoder - Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Sc
The Email Encoder - Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Sc
Share
External POC / Exploit Code
Leaving vuln.today