CVE-2023-4599

The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was issued in version 2.1.8. The vulnerability was fully patched in 2.1.9.

• CWE-79

• https://plugins.trac.wordpress.org/browser/email-encoder-bundle/tags/2.1.7/core/includes/classes/class-email-encoder-bundle-run.php#L529Product
• https://plugins.trac.wordpress.org/changeset/2958823/email-encoder-bundle#file60Product
• https://plugins.trac.wordpress.org/changeset/2994384/email-encoder-bundle/trunk?contextall=1&old=2958823&old_path=%2Femail-encoder-bundle%2Ftrunk#file0
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e90f04e4-eb4c-4822-89c6-79f553987c37?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/email-encoder-bundle/tags/2.1.7/core/includes/classes/class-email-encoder-bundle-run.php#L529Product
• https://plugins.trac.wordpress.org/changeset/2958823/email-encoder-bundle#file60Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e90f04e4-eb4c-4822-89c6-79f553987c37?source=cveThird Party Advisory

Published

Aug 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45960Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2023-45966umputun remark42 version 1.12.1 and before has a Blind Serve…7.5
• CVE-2023-4597The Slimstat Analytics plugin for WordPress is vulnerable to…6.4
• CVE-2023-4598The Slimstat Analytics plugin for WordPress is vulnerable to…6.5
• CVE-2023-45984TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V…9.8
• CVE-2023-45985TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V…7.5
• CVE-2023-45990Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allo…8
• CVE-2023-45992A vulnerability in the web-based interface of the RUCKUS Clo…9.6
• CVE-2023-45996SQL injection vulnerability in Senayan Library Management Sy…8.8
• CVE-2023-45998kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Cus…5.4
• CVE-2023-4600The AffiliateWP for WordPress is vulnerable to unauthorized …4.3
• CVE-2023-46001Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev57…5.5