Executive brief
The Email JavaScript Cloak plugin for WordPress, which is used to hide email addresses from automated bots, contains a security flaw. This vulnerability allows attackers with basic contributor-level access to embed malicious scripts into website pages. When other users or administrators visit these pages, the scripts can execute, potentially leading to unauthorized actions or data theft.
Technical details
The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied attributes within the 'email' shortcode. The vulnerability exists in all versions up to and including 1.03. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting malicious web scripts into the shortcode attributes. Because the plugin fails to sufficiently sanitize input or escape output, these scripts are stored on the server and executed in the browser of any user who views the affected page. This can lead to session hijacking or unauthorized administrative actions.
Affected products
- cgarvey (WordPress) Email JavaScript Cloak <= 1.03
Timeline
- 2026-06-24: advisory: NVD publication date