The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Checkmail |
|
| Wordpress |
|
No data.
No data.
References
History
Tue, 28 Apr 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Tue, 28 Apr 2026 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Checkmail
Checkmail check And Log Email Wordpress Wordpress wordpress |
|
| Vendors & Products |
Checkmail
Checkmail check And Log Email Wordpress Wordpress wordpress |
Tue, 28 Apr 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled | |
| Title | Check & Log Email < 2.0.13 - Unauthenticated Stored XSS | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-04-28T06:00:06.540Z
Reserved: 2026-04-01T08:45:45.786Z
Link: CVE-2026-5306
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-28T07:16:03.617
Modified: 2026-04-28T07:16:03.617
Link: CVE-2026-5306
Redhat
No data.