CVE-2026-5305: Stored XSS in Email Address Encoder WordPress Plugins—Patch Guidance

Technical summary

The Email Address Encoder plugin (versions before 1.0.25) and email-encoder-premium plugin (versions before 0.3.12) contain a Stored Cross-Site Scripting (XSS) vulnerability stemming from improper email replacement logic. The vulnerability exists in how the plugins process and encode email addresses for display. An unauthenticated attacker can inject JavaScript via a vector that bypasses the intended sanitization, and this payload is stored in the site's database or rendered content. When legitimate users or administrators visit the affected page, the malicious script executes in their browser context with the privileges of that user.

Business impact

If your WordPress site uses either of these plugins, attackers can deface pages, steal visitor data, capture admin session cookies, or redirect users to malicious sites. For e-commerce sites, this could expose customer payment information or credentials. The stored nature of the attack means damage continues until remediated. Reputational harm, compliance violations (GDPR, PCI-DSS), and potential legal liability for data breaches are realistic consequences.

Affected systems

WordPress installations using Email Address Encoder plugin version 1.0.24 or earlier, or email-encoder-premium plugin version 0.3.11 or earlier. This includes any site where these plugins are installed and activated, regardless of WordPress core version. Multisite WordPress networks are affected if any site uses the vulnerable plugin.

Exploitability

This vulnerability is highly exploitable. No authentication is required—an attacker can inject payloads via comments, posts, plugin settings, or other user-facing input vectors that the plugin processes. The CVSS score of 8.8 (HIGH) reflects the ease of exploitation (network-accessible, low complexity, no special privileges needed) and the severity of impact (confidentiality, integrity, and availability all compromised). However, user interaction is required; the injected script executes when a victim views the page.

Remediation

Update Email Address Encoder to version 1.0.25 or later, and email-encoder-premium to version 0.3.12 or later. After updating, audit your site's pages, posts, and comments for suspicious content inserted before the patch date. If you cannot immediately patch, disable the plugins until you can update. Consider using a Web Application Firewall rule to block script injection attempts.

Patch guidance

Log into your WordPress admin dashboard, navigate to Plugins > Installed Plugins, and update both Email Address Encoder and email-encoder-premium to their latest versions. Verify the update was successful by checking the plugin version numbers in the plugin details. Test email encoding functionality on a staging environment first if available. No database cleanup or configuration changes are required post-update, but review your plugin security settings and confirm strict input validation is enabled.

Detection guidance

Search your WordPress database for anomalous script tags or event handlers (script, iframe, onerror, onload, etc.) in post_content, postmeta, or comments tables, particularly in entries created before your patch date. Review plugin access logs if available. Monitor your site for unusual administrator account activity or unauthorized plugin installations. Use security scanning tools like Wordfence or Sucuri to identify injected content. Check web server access logs for suspicious referral patterns or unusual POST requests to plugin endpoints.

Why prioritize this

This is a HIGH-severity, unauthenticated, stored XSS affecting plugins likely installed on thousands of WordPress sites. Exploitation requires no special access, the impact spans confidentiality and integrity, and the stored nature means the threat persists until actively remediated. Prioritize patching within 72 hours, especially for sites handling sensitive user data or transactions.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network-accessible attack vector (AV:N), no special network conditions required (AC:L), no authentication needed (PR:N), user interaction required but realistic (UI:R), no scope escalation (S:U), and high impact across all three pillars—confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the ease of exploitation and the serious nature of stored XSS on a widely-deployed platform.

Frequently asked questions