{"id":"CVE-2026-5305","aliases":["EUVD-2026-39187","GHSA-gcp6-956h-2589"],"status":"published","title":"Email Address Encoder (Free \u003c 1.0.25, Premium \u003c 0.3.12) - Unauthenticated Stored XSS","description":"The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00505,"percentile":0.43469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-06-25T06:00:02Z","modified":"2026-06-25T15:33:04Z","products":[{"vendor":"till krüss","product":"email address encoder"},{"vendor":"unknown","product":"email address encoder"},{"vendor":"unknown","product":"email-encoder-premium"}],"references":[{"url":"https://wpscan.com/vulnerability/bf59610b-98ba-4c05-b2fc-85c163e9a389/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5305"},{"url":"https://wpscan.com/vulnerability/bf59610b-98ba-4c05-b2fc-85c163e9a389"},{"url":"https://github.com/advisories/GHSA-gcp6-956h-2589"}],"sources":{"cve":[{"id":"CVE-2026-5305","title":"Email Address Encoder (Free \u003c 1.0.25, Premium \u003c 0.3.12) - Unauthenticated Stored XSS","description":"The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks","status":"published","published":"2026-06-25T06:00:02.068Z","modified":"2026-06-25T12:39:14.03Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T13:39:27.849196Z"}],"euvd":[{"id":"EUVD-2026-39187","description":"The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks","status":"published","published":"2026-06-25T06:00:02Z","modified":"2026-06-25T12:39:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:29.723653Z"}],"ghsa":[{"id":"GHSA-gcp6-956h-2589","title":"The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin...","description":"The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks","status":"published","published":"2026-06-25T09:31:17Z","modified":"2026-06-25T15:33:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:08:59.328511Z"}],"nvd":[{"id":"CVE-2026-5305","description":"The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks","status":"published","published":"2026-06-25T07:16:45.737Z","modified":"2026-06-25T13:28:35.737Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:25.67873Z"}]}}