Email Encoder – Protect Email Addresses and Phone Numbers Plugin Vulnerability (CVE-2026-2840)

Security Alert Summary

The Email Encoder – Protect Email Addresses and Phone Numbers WordPress plugin contains a stored cross-site scripting (XSS) vulnerability via the eeb_mailto shortcode in all versions up to and including 2.4.4. Authenticated users with contributor-level access or higher can inject scripts that will execute whenever a visitor or site user views an affected page.

CVE Details

• CVE ID: CVE-2026-2840
• Affected component: Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress (the eeb_mailto shortcode)
• Affected versions: All versions up to and including 2.4.4
• Published: April 16, 2026 3:17:17 PM
• Last modified: April 16, 2026 3:17:17 PM
• CVSS v3.1: Base score 6.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Authentication / privileges / user interaction: Requires an authenticated user with low privileges (contributor level or higher). No user interaction is required for the injected payload to run once a page is viewed.
• Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
• Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-site Scripting)

Technical Details

This vulnerability is a stored cross-site scripting issue triggered by the eeb_mailto shortcode. The plugin fails to sufficiently sanitize input and escape output for content passed through that shortcode, allowing authenticated attackers with contributor-level access or higher to store arbitrary web scripts in pages or posts. When other users (including administrators, editors, or site visitors) view an infected page, the stored script is executed in their browser context.

The root cause is insufficient input validation and missing or incomplete output escaping for user-provided content used by the shortcode. Because the payload is stored in site content, it persists and runs on each page view until the content is cleaned or the plugin is updated.

How This Could Impact Your Website

Consider a site where the owner manages content and several staff members or external contributors add or edit posts. An external contributor or contractor with contributor-level access could add a malicious payload via the eeb_mailto shortcode on a post. When internal staff or site visitors open that post, the injected script could run in their browsers.

• Attackers could attempt to capture session tokens or other data available to the browser, increasing the risk of targeted account takeover for users who view the infected page.
• Stored XSS can be used to display malicious content or forms to users, increasing the likelihood of successful phishing or social engineering against staff or customers.
• Content integrity can be affected if visible content is altered by injected scripts; availability impact is not indicated by the CVSS data.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Review and reduce unnecessary user roles, especially limiting contributor access where possible.
• Enforce strong passwords and enable two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins from your site.
• Monitor site activity and logs for unusual behavior, including unexpected content changes or new posts from low-privileged accounts.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/changeset?old_path=/email-encoder-bundle/tags/2.4.4/src/Front/Shortcodes/MailtoShortcode.php&new_path=/email-encoder-bundle/tags/2.4.5/src/Front/Shortcodes/MailtoShortcode.php&old=3462208&new=3494181
• https://plugins.trac.wordpress.org/changeset?old_path=/email-encoder-bundle/tags/2.4.4/src/Validate/Encoding.php&new_path=/email-encoder-bundle/tags/2.4.5/src/Validate/Encoding.php&old=3462208&new=3494181
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9987b5b4-33d8-4446-acbe-58c6cb5604df?source=cve