CVE-2026-5776: Undefined Security Weakness

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

CVE-2026-2840: Improper Neutralization of Input During Web Page Generation

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eebmailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-4483: Improper Neutralization of Input During Web Page Generation

The Email Encoder WordPress plugin before 2.2.2 does not escape the WPEmailEncoderBundleoptionsprotectiontext parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting...

CVE-2024-1282: Improper Neutralization of Input During Web Page Generation

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

PT-2024-17748

Name of the Vulnerable Software and Affected Versions The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress versions up to, and including, 2.2.0 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping ...

CVE-2023-7070: Improper Neutralization of Input During Web Page Generation

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eebmailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes...

PT-2021-16114

Name of the Vulnerable Software and Affected Versions The Email Encoder – Protect Email Addresses WordPress plugin versions prior to 2.1.2 Description The issue concerns an endpoint that requires no authentication and will render a user-supplied value in the HTML response without escaping or...

CVE-2021-24599: Improper Neutralization of Input During Web Page Generation

The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data...