CVE-2024-4483

The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - contact@wpscan.com

Published

2024-07-29

Last modified

2024-08-01

Weaknesses

CWE-79

Affected products

• Email Encoder (Jannisthuemmig)
• Email Encoder (Unknown)
• Email Encoder (Wp-webhooks)

References

• https://wpscan.com/vulnerability/8f2ac76c-f3f8-41f9-a32a-f414825cf6f1/