CVE-2026-10091: Stored XSS in Email JavaScript Cloak WordPress Plugin

Technical summary

CVE-2026-10091 is a Stored Cross-Site Scripting (XSS) vulnerability in the Email JavaScript Cloak WordPress plugin affecting all versions through 1.03. The vulnerability resides in the plugin's 'email' shortcode handler, which processes user-supplied shortcode attributes without adequate input sanitization or output escaping. An authenticated attacker with contributor or higher privileges can embed arbitrary JavaScript within shortcode parameters. Because the malicious payload is stored in the WordPress database and rendered to all subsequent visitors, every page load triggers script execution in victim browsers, creating a persistent attack vector. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Compromise of website integrity and visitor trust represents the primary business risk. Attackers can deface content, redirect users to malicious sites, harvest credentials through fake login forms, deploy malware, or perform actions on behalf of legitimate users. For organizations relying on the Email JavaScript Cloak plugin, the attack surface extends to all authenticated users with contributor access or above—potentially including third-party content creators, freelance editors, or compromised staff accounts. Each page containing injected code becomes a pivot point for broader account compromise or malware distribution.

Affected systems

The Email JavaScript Cloak WordPress plugin is affected in all versions up to and including 1.03. This impacts WordPress installations where the plugin is actively installed and enabled. The plugin version number should be verified in the WordPress admin dashboard under Plugins. Organizations should audit installed plugin versions and conduct a code review to determine if the 'email' shortcode is actively used in published content.

Exploitability

Exploitation requires authenticated access with contributor-level privileges or above. An attacker cannot exploit this vulnerability from an unauthenticated state. However, contributor access is a relatively permissive role commonly granted to freelance writers, guest authors, and content partners. The attack is trivial to execute once authorized—simply embedding a malicious shortcode in a post or page. No user interaction beyond normal site browsing is required to trigger the injected script. The CVSS score of 7.2 (HIGH) reflects the ease of exploitation balanced against the authentication barrier and scope of impact.

Remediation

Update the Email JavaScript Cloak plugin to a version released after 1.03 that includes input sanitization and output escaping fixes. Verify the availability of a patched version through the official WordPress plugin repository or the plugin developer's website. If no patch is available, consider disabling or removing the plugin and selecting an alternative email obfuscation solution. Additionally, audit your WordPress user roles and limit contributor access to trusted individuals only.

Patch guidance

Check the WordPress plugin repository or plugin developer changelog for a released version newer than 1.03. Apply updates through the WordPress admin dashboard (Plugins > Updates) or via command line tools like WP-CLI. Before updating, back up your WordPress database and verify plugin compatibility with your current WordPress version. Test the update in a staging environment if possible to ensure no content breaks. If the plugin author has not released a patch within a reasonable timeframe, evaluate alternative plugins or consider removing the Email JavaScript Cloak plugin entirely.

Detection guidance

Search your WordPress database and page content for instances of the 'email' shortcode using WordPress admin search or database queries (e.g., searching posts_content for '[email'). Review recent post and page revisions to identify unauthorized or suspicious modifications, particularly those edited by user accounts with contributor or editor roles. Enable and monitor WordPress security plugins that detect malicious shortcode patterns. Examine browser console and network logs on affected pages for unexpected JavaScript execution. Review WordPress user login logs and audit trails for unauthorized editor or contributor account creation or privilege escalation.

Why prioritize this

Although this vulnerability requires authenticated access, contributor-level accounts are common in multi-author WordPress environments. The persistence of Stored XSS makes it a high-priority issue—once injected, malicious code executes for every visitor without needing re-exploitation. The CVSS score of 7.2 reflects significant confidentiality and integrity impact. Organizations with multiple contributors, guest authors, or frequently compromised accounts should prioritize patching or disabling this plugin to prevent site-wide compromise and visitor exposure.

Risk score, explained

The CVSS v3.1 score of 7.2 (HIGH) is calculated using vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. This score reflects: Attack Vector (Network)—the vulnerability is exploitable over the network; Attack Complexity (Low)—no special conditions required; Privileges Required (None)—the score assumes an attacker is already authenticated; Scope (Changed)—the impact extends beyond the vulnerable component to the web application as a whole; Confidentiality and Integrity (Low)—data can be leaked or modified, but availability is not impacted. The score appropriately balances the ease of exploitation against the persistent impact of Stored XSS.

Frequently asked questions