The Email JavaScript Cloak plugin for WordPress suffers from insufficient input sanitization and output escaping on user‑supplied attributes in its email shortcode. This flaw turns the shortcode into a vector for stored cross‑site scripting, allowing any injected JavaScript to run whenever an affected page is viewed. The vulnerability specifically enables contributors and higher‑privileged users to insert malicious scripts into site content that will persist and impact all visitors to the affected pages, potentially exposing credentials, defacing content, or facilitating further attacks.

All installations of the cgarvey Email JavaScript Cloak plugin with version 1.03 or earlier are affected. The vulnerability applies to every WordPress site where the plugin is installed and the email shortcode is used in pages or posts. Users affected are those running WordPress sites that have included this plugin in any form from its release up to and including version 1.03.

The flaw carries a CVSS score of 7.2, reflecting a high impact when exploited. EPSS data is currently unavailable, so usage patterns are unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers require contributor‑level access or higher, which is commonly granted to site editors or authors. By encoding scripts into the shortcode’s attributes, an authenticated user can store malicious code that will execute for all users who view the affected page, creating a persistent XSS risk.