Email Encoder Bundle Vulnerabilities

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will exec...

CVSS:

7.2

Affected:

up to 2.4.7

Fixed in:

2.4.7

Disclosed:

Jun 11, 2026

CVE-2026-5776 on NVD →

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arb...

CVSS:

4.4

Affected:

up to 2.3.4

Fixed in:

2.3.4

Disclosed:

Apr 21, 2026

CVE-2024-7083 on NVD →

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Apr 15, 2026

CVE-2026-2840 on NVD →

[en] The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting

Affected:

up to 2.2.2

Fixed in:

2.2.2

Disclosed:

Jul 29, 2024

CVE-2024-4483 on NVD →

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'WP_Email_Encoder_Bundle_options[protection_text]' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possi...

CVSS:

4.4

Affected:

up to 2.2.1

Fixed in:

2.2.2

Disclosed:

Jul 8, 2024

CVE-2024-4483 on NVD →

[en] The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

Affected:

up to 2.2.1

Fixed in:

2.2.1

Disclosed:

Feb 20, 2024

CVE-2024-1282 on NVD →

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut...

CVSS:

6.4

Affected:

up to 2.2.0

Fixed in:

2.2.1

Disclosed:

Feb 13, 2024

CVE-2024-1282 on NVD →

[en] The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eeb_mailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it pos...

Affected:

up to 2.1.10

Fixed in:

2.1.10

Disclosed:

Jan 11, 2024

CVE-2023-7070 on NVD →

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eeb_mailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVSS:

6.4

Affected:

up to 2.1.9

Fixed in:

2.1.10

Disclosed:

Jan 9, 2024

CVE-2023-7070 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.

Affected:

up to 2.1.9

Fixed in:

2.1.9

Disclosed:

Nov 22, 2023

CVE-2023-47821 on NVD →

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut...

CVSS:

6.4

Affected:

up to 2.1.8

Fixed in:

2.1.9

Disclosed:

Nov 15, 2023

CVE-2023-47821 on NVD →

[en] The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor...

Affected:

up to 2.1.9

Fixed in:

2.1.9

Disclosed:

Aug 30, 2023

CVE-2023-4599 on NVD →

The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and...

CVSS:

6.4

Affected:

up to 2.1.8

Fixed in:

2.1.9

Disclosed:

Aug 29, 2023

CVE-2023-4599 on NVD →

[en] The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.

Affected:

up to 2.1.2

Fixed in:

2.1.2

Disclosed:

Sep 6, 2021

CVE-2021-24599 on NVD →

The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.

CVSS:

6.1

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Aug 2, 2021

CVE-2021-24599 on NVD →

The Email Encoder plugin for WordPress is vulnerable to Cross-Site Scripting via 'email' and 'display' parameters in versions before 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Aug 10, 2015

The Email Encoder plugin for WordPress is vulnerable to Cross-Site Scripting via 'email' and 'display' parameters in versions before 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Aug 10, 2015

Because of this vulnerability, unauthenticated users can inject HTML or JS code. Update the plugin.

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Aug 10, 2015

The Email Encoder &ndash; Protect Email Addresses WordPress plugin was affected by an Unauthenticated Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.4.2

Fixed in:

1.4.2