What is the CVSS score of EUVD-2026-39187?

EUVD-2026-39187 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Email Address Encoder are affected by EUVD-2026-39187?

The Email Address Encoder WordPress plugin contains a vulnerability that allows unauthenticated attackers to inject malicious code targeting administrator accounts, affecting any site running…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-39187?

Yes, a public proof-of-concept exploit is available for EUVD-2026-39187. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-39187?

24 hours: Identify all WordPress installations running Email Address Encoder or Email Encoder Premium; document current plugin versions in affected environments. 7 days: Update Email Address Encoder to version 1.0.25 or later and Email Encoder Premium to version 0.3.12 or later on all identified sites; review administrator activity logs from the past 30 days for indicators of unauthorized access. 30 days: Verify completion of patch deployment across all systems; conduct security assessment of affected administrator accounts for evidence of compromise.

Email Address Encoder EUVD-2026-39187

| CVE-2026-5305 HIGH

2026-06-25 WPScan

GHSA-gcp6-956h-2589

WordPress XSS Email Address Encoder Email Encoder Premium Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (PR:N, AV:N, AC:L) but execution needs a victim to view the page (UI:R); Stored XSS runs in another security context (S:C) with limited confidentiality/integrity impact and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 13:23 vuln.today

CVSS changed

Jun 25, 2026 - 13:22 NVD

8.8 (HIGH)

Patch available

Jun 25, 2026 - 08:01 EUVD

CVE Published

Jun 25, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 25, 2026 - 06:00 cve.org

HIGH 8.8

DescriptionCVE.org

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 1 Critical, 6 High, 2 With POC Jun 26, 2026

AnalysisAI

Stored cross-site scripting in the Email Address Encoder WordPress plugin (free, before 1.0.25) and its Email Encoder Premium counterpart (before 0.3.12) lets unauthenticated visitors inject persistent JavaScript through the plugin's flawed email-replacement handling. Publicly available exploit code exists (disclosed by WPScan) and a vendor patch is available, but it is not in CISA KEV, so there is no public exploit identified as actively used in the wild. Successful exploitation executes attacker script in the browser of any user who later renders the affected page, typically an authenticated administrator.

Technical ContextAI

Both plugins exist to obfuscate email addresses in WordPress page content to defeat spam harvesters, performing string substitution on rendered output. The flaw is an improper input-neutralization/output-encoding failure in that email-replacement routine - an Improper Neutralization of Input During Web Page Generation issue (CWE-79, Stored XSS), even though the CWE field was supplied as N/A. Because the unsanitized value is stored and re-served, the injected payload executes in the security context of the WordPress site on every subsequent page render. The CPE strings (cpe:2.3:a:unknown:email_address_encoder and cpe:2.3:a:unknown:email-encoder-premium) confirm the two distinct distributions affected; the vendor is listed as 'unknown' in CPE, with WPScan/EUVD as the authoritative sources.

RemediationAI

Upgrade to Email Address Encoder 1.0.25 or later, and Email Encoder Premium 0.3.12 or later - a vendor patch is available per the WPScan advisory (https://wpscan.com/vulnerability/bf59610b-98ba-4c05-b2fc-85c163e9a389/), though no further granular fix metadata beyond these threshold versions was provided. If immediate patching is not possible, deactivate and remove the affected plugin to eliminate the vulnerable replacement code (trade-off: email addresses revert to plaintext and lose obfuscation protection), or place a WAF/virtual-patch rule in front of the site to filter script payloads in inputs that flow into email-encoded content (trade-off: rule tuning and possible false positives). Additionally restrict who can submit the content that feeds the replacement routine and audit existing stored content for previously injected payloads, since Stored XSS persists until the underlying records are cleaned.