CVE-2025-28976
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through <= 3.3.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS vulnerability in WordPress Email Address Security by WebEmailProtector plugin up to version 3.3.6 allows attackers to inject malicious scripts via user interaction.
The WordPress plugin Email Address Security by WebEmailProtector (webemailprotector) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. Versions through 3.3.6 are affected [1].
Exploitation requires a privileged user to perform an action, such as clicking a malicious link or visiting a crafted page. An attacker can inject arbitrary scripts that are stored and later executed in the context of a visitor's browser [1].
Successful exploitation allows the attacker to inject malicious scripts, including redirects, advertisements, or other HTML payloads, impacting any user who visits the affected site [1].
Users should update to a patched version immediately. Patchstack provides a mitigation rule for those unable to update [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.