Email Encoder Protect Email Addresses And Phone Numbers
Monthly
Stored Cross-Site Scripting in the Email Encoder - Protect Email Addresses and Phone Numbers WordPress plugin (versions ≤ 2.4.4) allows authenticated contributors to inject persistent JavaScript via the 'eeb_mailto' shortcode due to missing sanitization in MailtoShortcode.php. When any user visits a page containing the poisoned shortcode, the injected script executes in their browser, enabling session hijack, credential theft, or admin account takeover. EPSS sits at 0.03% (8th percentile) and CISA SSVC records exploitation as none, placing current real-world risk low despite the scope-changed CVSS of 6.4.
Stored Cross-Site Scripting in the Email Encoder - Protect Email Addresses and Phone Numbers WordPress plugin (versions ≤ 2.4.4) allows authenticated contributors to inject persistent JavaScript via the 'eeb_mailto' shortcode due to missing sanitization in MailtoShortcode.php. When any user visits a page containing the poisoned shortcode, the injected script executes in their browser, enabling session hijack, credential theft, or admin account takeover. EPSS sits at 0.03% (8th percentile) and CISA SSVC records exploitation as none, placing current real-world risk low despite the scope-changed CVSS of 6.4.