The WordPress plugin Email Encoder – Protect Email Addresses and Phone Numbers fails to sanitize or escape user‑supplied data supplied to its eeb_mailto shortcode. Consequently, an attacker with contributor or higher access can store malicious JavaScript within a page. When other users view or load that page, the stored script executes in their browsers, allowing the attacker to run arbitrary code in the context of the site.

All WordPress installations running Email Encoder – Protect Email Addresses and Phone Numbers plugin version 2.4.4 or earlier are vulnerable. The flaw is exploitable only in environments that grant contributors or higher roles the ability to edit content, such as posts or pages.

The CVSS base score is 6.4, denoting moderate severity. Exploitation requires authenticated access with contributor privileges, which are commonly granted to content authors. There is no EPSS score available and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation at present.