CVE-2026-5306

The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.15% chance of exploitation in the next 30 days, 5th percentile

Published

2026-04-28

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/97908c15-6e7a-4242-8c6f-66c8b804364c/

References

• CVE Record
• NVD entry

Related

• CVE-2026-5305
• CVE-2026-53075
• CVE-2026-5296
• CVE-2026-5309
• CVE-2026-52943
• CVE-2026-5310