CVE Catalog
CVE-2026-5776
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.25%
17th percentile - higher than 17% of all known CVEs
Summary
The Email Encoder WordPress plugin before version 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks.
Risk Assessment
An unauthenticated attacker can inject arbitrary scripts that execute whenever a user visits the page, potentially leading to session theft or other attacks.
Recommendation
Update the Email Encoder plugin to version 2.4.7 or later.
Original NVD description (English source)
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks