The Hide Email Address plugin for WordPress includes a stored cross‑site scripting vulnerability that is triggered by submitting malicious content to the inline_css attribute of its shortcode. An attacker who can add or edit posts with contributor or higher privileges can place arbitrary JavaScript in the inline_css field; when any user views the page, the payload executes with the user’s browser context. This can lead to session hijacking, content injection, or defacement of the site, representing a serious threat to confidentiality, integrity, and availability of the website’s content and user sessions.

The vulnerability affects the buntegiraffe Hide Email Address WordPress plugin, versions up to and including 0.1. No other products or versions are listed as affected.

The CVSS score of 6.4 indicates a moderate severity while the EPSS score of less than 1% shows a low probability of exploitation at this time. The vulnerability is not in the CISA KEV catalog. Exploitation requires that the attacker has authenticated access with Contributor or higher privileges, which is a moderate access requirement. Once achieved, the exploit is straightforward: submit malicious code via the inline_css attribute and rely on its execution in subsequent page views. The risk is mitigated by a lack of a public exploit, but the presence of the vulnerability in a widely used plugin warrants prompt remediation.