The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via...

CVE-2026-5776 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

Basic information

Type: unreviewed
Severity: unknown
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Not specified
Published (advisory): 2026-05-20 09:30:34 UTC
Updated: 2026-05-20 09:30:37 UTC
NVD published: 2026-05-20

EPSS Score

Score	Percentile
0.05%	16.04%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-hmgx-5p26-ccf2 ↗
CVE	CVE-2026-5776 ↗

References

https://nvd.nist.gov/vuln/detail/CVE-2026-5776
https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f
https://github.com/advisories/GHSA-hmgx-5p26-ccf2

cvelogic Threat Intelligence