# CVE-2026-5776: Email Encoder WordPress plugin stored XSS in email input

Source: https://junglewise.ai/threats/cve-2026-5776-email-encoder-wordpress-plugin-stored-xss-in-email-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-5776 · Severity: info · CVSS 8.8 · Published 2026-05-20

The Email Encoder plugin for WordPress, which is used to protect email addresses from being scraped by bots, contains a security flaw. An unauthenticated attacker can submit a malicious email address through public forms like comments. If an administrator views or approves this content, the attacker can execute malicious scripts in the administrator's browser, potentially leading to unauthorized site changes or data theft.

Vendors: [WPScan](https://junglewise.ai/threats/vendors/wpscan).

## Quick answers

**Is CVE-2026-5776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5776 being exploited in the wild.

**How severe is CVE-2026-5776?** Informational severity, with a CVSS score of 8.8, published 20 May 2026.

**Which products and versions are affected?** WPScan Email Encoder < 2.4.7.

**Is there a fix for CVE-2026-5776?** A patch was published on 2026-04-29: Fixed in version 2.4.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5776 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5776?** Check whether you run WPScan Email Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Email Encoder plugin (versions prior to 2.4.7) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly sanitize or escape email addresses retrieved from user-supplied input, such as comment fields. An unauthenticated attacker can inject malicious JavaScript within a 'mailto' link. When a site administrator views the pending comment in the WordPress dashboard or when the comment is rendered on the front end, the script executes in the context of the user's session. This can be used to hijack administrative sessions or perform unauthorized actions on the WordPress site. The issue is fixed in version 2.4.7.

## Affected products

- WPScan Email Encoder < 2.4.7

## Timeline

- 2026-04-29: disclosed: Publicly published by WPScan
- 2026-04-29: patched: Fixed in version 2.4.7
- 2026-05-20: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/](https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/)

## Related threats

- [WordPress Email Encoder Stored XSS in plugin settings](https://junglewise.ai/threats/cve-2024-7083-wordpress-email-encoder-stored-xss-in-plugin-settings)