# CVE-2024-7083: WordPress Email Encoder Stored XSS in plugin settings

Source: https://junglewise.ai/threats/cve-2024-7083-wordpress-email-encoder-stored-xss-in-plugin-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2024-7083 · Severity: low · CVSS 3.5 · Published 2026-04-20

The Email Encoder plugin for WordPress, which is used to protect email addresses from being harvested by bots, contains a security vulnerability. This flaw allows high-privileged users, such as site administrators, to inject malicious scripts into the website's settings. These scripts could then execute in the browsers of other users, potentially leading to unauthorized actions or data theft, even in restricted environments like WordPress Multisite.

Vendors: [WPScan](https://junglewise.ai/threats/vendors/wpscan).

## Quick answers

**Is CVE-2024-7083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-7083 being exploited in the wild.

**How severe is CVE-2024-7083?** Low severity, with a CVSS score of 3.5, published 20 April 2026.

**Which products and versions are affected?** WPScan Email Encoder < 2.3.4.

**Is there a fix for CVE-2024-7083?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-7083 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-7083?** Check whether you run WPScan Email Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Email Encoder plugin for WordPress fails to properly sanitize and escape input in its settings, specifically within the 'WP_Email_Encoder_Bundle_options[protection_text]' parameter. An attacker with high privileges (such as an Administrator) can inject a malicious payload that is stored in the database. This payload is subsequently executed in the context of a victim's browser when they visit pages or posts where the '[eeb_protect_content]' shortcode is embedded. This vulnerability is particularly relevant in WordPress Multisite environments where the 'unfiltered_html' capability is typically restricted for site admins. The issue is fixed in version 2.3.4.

## Affected products

- WPScan Email Encoder < 2.3.4

## Timeline

- 2026-03-30: disclosed: Publicly published by WPScan
- 2026-04-20: advisory: NVD published date

## References

- [https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/](https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/)

## Related threats

- [Email Encoder WordPress plugin stored XSS in email input](https://junglewise.ai/threats/cve-2026-5776-email-encoder-wordpress-plugin-stored-xss-in-email-input)