{"id":"CVE-2026-5306","aliases":["EUVD-2026-25995","GHSA-p8g5-jxr9-99q9"],"status":"published","title":"Check \u0026 Log Email \u003c 2.0.13 - Unauthenticated Stored XSS","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00155,"percentile":0.04695,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-04-28T06:00:06Z","modified":"2026-06-17T10:58:47Z","products":[{"vendor":"unknown","product":"check \u0026 log email"}],"references":[{"url":"https://wpscan.com/vulnerability/97908c15-6e7a-4242-8c6f-66c8b804364c/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5306"},{"url":"https://wpscan.com/vulnerability/97908c15-6e7a-4242-8c6f-66c8b804364c"},{"url":"https://github.com/advisories/GHSA-p8g5-jxr9-99q9"}],"sources":{"cve":[{"id":"CVE-2026-5306","title":"Check \u0026 Log Email \u003c 2.0.13 - Unauthenticated Stored XSS","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled","status":"published","published":"2026-04-28T06:00:06.54Z","modified":"2026-04-28T14:14:55.661Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T13:39:39.001586Z"}],"euvd":[{"id":"EUVD-2026-25995","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled","status":"published","published":"2026-04-28T06:00:06Z","modified":"2026-04-28T14:14:55Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:16.972131Z"}],"ghsa":[{"id":"GHSA-p8g5-jxr9-99q9","title":"The Check \u0026 Log Email  WordPress plugin before 2.0.13 does not properly handle email replacement,...","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled","status":"published","published":"2026-04-28T09:34:12Z","modified":"2026-04-28T15:30:49Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:07:40.70295Z"}],"nvd":[{"id":"CVE-2026-5306","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled","status":"published","published":"2026-04-28T07:16:03.617Z","modified":"2026-06-17T10:58:47.06Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:16.252509Z"}]}}