The Email Encoder WordPress plugin prior to version 2.4.7 does not escape email addresses that come from user input. Unfiltered email strings are stored in the database and displayed on the front‑end, which allows an unauthenticated attacker to inject arbitrary JavaScript. The injected code will execute for any visitor who views the affected page, making the issue a stored cross‑site scripting vulnerability.

All WordPress sites that use the Email Encoder plugin with a version older than 2.4.7 are vulnerable. Sites that have not updated the plugin remain at risk.

The CVSS score of 6.1 signals medium severity, while the EPSS score of < 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, meaning no confirmed exploits have been documented. Because the flaw is stored and unauthenticated, any user can submit an email address that is stored and later rendered on the front‑end without escaping, allowing a malicious script to run for any visitor who views the affected page.