CVE-2024-1282Medium· 6.4▾ Sunlit

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.2.0 due to insufficient input sanitizat…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 35.2 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Feb 29, 2024

Updated

Jul 22, 2026

CVSS

6.4

Vendor

onlineoptimisation

Product

email_encoder

CWE

CWE-79, CWE-79

Depth score

35 · Low

EPSS

0.44% · p38

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 22.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 874 days

Feb 29, 2024Published
Disclosed via NVD
Jul 22, 2026Record revised
Last analysed / modified upstream
Jul 22, 2026EPSS first tracked
0.4%

onlineoptimisation CWE-79 CWE-79 #nvd

Affected

email_encoder < 2.2.1

Patched in

email_encoder 2.2.1

Full technical detail▾

Overview

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected

email_encoder < 2.2.1

Remediation

Upgrade past the affected range:

email_encoder 2.2.1

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd