VulnerabilityDeferred

CVE-2026-5776

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

MEDIUM 6.1EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.