CVE-2026-5776

MediumCVSS 6.1/10Last modified Jul 24, 2026

Description

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

VendorProductVersions
UnknownEmail Encoder< 2.4.7

References

Timeline

Published
May 20, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-577605.3Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2026-577617.1Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.CVE-2026-577625.9Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.CVE-2026-577636.5Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.CVE-2026-577646.5Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.CVE-2026-577658.5Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.CVE-2026-577668.8Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.CVE-2026-577677.1Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.CVE-2026-577688.2Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issuCVE-2026-577697.1Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.CVE-2026-57778.7This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service over the local networkCVE-2026-577709.8Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects
CVE-2026-5776: Medium severity, CVSS 6.1 | Vulnix