CVE-2026-5776
Email Encoder < 2.4.7 - Unauthenticated Stored XSS
MEDIUM 6.1EPSS 0.3%
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
- Affected
- Email Encoder
- CVSS v3.1 CNA
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.27% chance of exploitation in the next 30 days, 19th percentile
- Published
- 2026-05-20