CVE-2026-5776

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

May 20, 2026

CISA due date

—

The record

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

Affected packages

Ecosystem	Package	Introduced	Fixed