Email Address Encoder Vulnerabilities

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected...

CVSS:

7.2

Affected:

up to 1.0.25

Fixed in:

1.0.25

Disclosed:

Jun 4, 2026

CVE-2026-5305 on NVD →

The Email Address Encoder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.23. This is due to missing or incorrect nonce validation on the eae_clear_caches() function. This makes it possible for unauthenticated attackers to flush page caches via a forged request gra...

CVSS:

4.3

Affected:

up to 1.0.23

Fixed in:

1.0.24

Disclosed:

Aug 26, 2024

CVE-2024-43927 on NVD →

The Email Address Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eae_shortcode shortcode in version 1.0.22 due to insufficient input sanitization and output escaping on the 'link' user supplied attribute. This makes it possible for authenticated attackers with contributor-lev...

CVSS:

6.4

Affected:

1.0.22 – 1.0.22

Fixed in:

1.0.23

Disclosed:

Nov 28, 2023

CVE-2023-48765 on NVD →