Skip to content
Sign in
5.4 Medium

CVE-2024-4483 The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text]…

Description

The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting

Affected products and versions

Product Affected versions Fixed in
Email Encoder 2.2 earliest → < 2.2.2 2.2.2
email_encoder 2.2 earliest → < 2.2.2 2.2.2

Other CVEs of Email Encoder

The 3 CVEs of Email Encoder →
CVE-2026-5776 The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing… 6.1 Medium CVE-2024-7083 The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow… 3.5 Low
Track this CVE