← WordPress Vulnerabilities
WordPress security by component

Email Encoder

Email Encoder is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published May 20, 2026; the highest CVE/CNA score is 6.1.

Plugin slug: email-encoder

CVE-2026-5776: Email Encoder: Cross-site scripting

Email Encoder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 2.4.7.

PublishedMay 20, 2026
Known safe version2.4.7
Safe version
May 20, 2026 CVE-2026-5776
Email Encoder: Cross-site scripting
Email Encoder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 2.4.7.
2.4.7
CVE6.1
NVDPending
Apr 20, 2026 CVE-2024-7083
Email Encoder: Cross-site scripting
Email Encoder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 2.3.4.
2.3.4
CVE3.5
NVDPending
Jul 29, 2024 CVE-2024-4483
Email Encoder: Cross-site scripting
Email Encoder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.4
NVDPending
Sep 06, 2021 CVE-2021-24599
Email Encoder – Protect Email Addresses: A security weakness
Email Encoder – Protect Email Addresses is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.1
NVD6.1