High severity8.8NVD Advisory· Published Jun 25, 2026· Updated Jun 25, 2026

CVE-2026-5305

Description

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

Affected products

WordPress/Email Address Encoderllm-fuzzy
Range: <1.0.25
Package: https://wordpress.org/plugins/email-address-encoder
WordPress/email-encoder-premiumllm-fuzzy
Range: <0.3.12

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/bf59610b-98ba-4c05-b2fc-85c163e9a389/nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000