CVE-2026-5776

Description

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

PUBLISHED Reserved 2026-04-08 | Published 2026-05-20 | Updated 2026-05-20 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Credits

Matthew Rollings finder

WPScan coordinator

References

wpscan.com/...rability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/ exploit vdb-entry technical-description

cve.org (CVE-2026-5776)

nvd.nist.gov (CVE-2026-5776)

Download JSON