Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Wp-webhooks Component: Email Encoder Clear all filters
TI-2024-04170 CVE-2024-4483 · GHSA-w3pw-m4q2-x98m

Email Encoder < 2.2.2 - Admin+ Stored XSS

Priority MEDIUM 58

The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Sc…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00378 Published 2024-07-29 Fixed in 2.2.2 CWE-79
TI-2023-04243 CVE-2023-4599 · GHSA-76p2-85pf-cqf5

Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on use…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00519 Published 2023-08-30 No fix listed CWE-79
TI-2021-06882 CVE-2021-24599 · GHSA-vwmw-f3cr-593g

Email Encoder < 2.1.2 - Reflected Cross Site Scripting

Priority LOW 29

The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00855 Published 2021-09-06 Fixed in 2.1.2 CWE-79