Executive brief
The My Email Shortcode plugin for WordPress, which allows users to easily embed email links into posts, contains a security flaw. An attacker with basic contributor-level access can inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'subject' attribute within the 'my-email' shortcode. This vulnerability exists in all versions up to and including 0.91. An authenticated attacker with Contributor-level permissions or higher can exploit this by embedding a malicious script within the shortcode attribute. When a user (including administrators) views the post or page containing the shortcode, the script executes in their browser context. This can lead to session hijacking, unauthorized administrative actions, or further site compromise.
Affected products
- WordPress My Email Shortcode Up to, and including, 0.91
Timeline
- 2026-05-27: disclosed: Initial publication of the CVE record.