The WordPress plugin Email Encoder releases settings that are not sanitized or escaped, allowing administrators to embed malicious scripts that will be persisted and served to other users. Attackers with administrative privileges can exploit this flaw to inject JavaScript into the site, potentially hijacking user sessions, defacing content, or leaking sensitive data. The weakness is a classic case of CWE‑79, improper neutralization of input during web page generation.

Any WordPress installation that uses the Email Encoder plugin with a version earlier than 2.3.4 is affected. The issue applies regardless of whether the unfiltered_html capability is enabled, meaning multisite setups and other configurations that restrict unfiltered_html are still vulnerable to this Stored XSS attack.

The vulnerability can be exploited by logging in as an administrator and inserting a crafted setting value that persists as a script. Since stored XSS affects all users who view the affected page, the impact is wide. The CVSS score is 3.5 and the EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog, but the potential for widespread cross‑site script execution makes it a high‑risk concern. The likely attack vector is via authenticated access to the plugin’s administrative interface.