What is GHSA-gcp6-956h-2589?

GHSA-gcp6-956h-2589 is a security advisory published by GitHub Security Advisories with High severity. The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin...

Which CVE IDs does GHSA-gcp6-956h-2589 cover?

GHSA-gcp6-956h-2589 covers the following CVE IDs: CVE-2026-5305. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gcp6-956h-2589?

GHSA-gcp6-956h-2589 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-gcp6-956h-2589HighCVSS 8.8

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin...

Vendor

GitHub Security Advisories

Published

June 25, 2026

Last Modified

June 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-5305 →

📋 Description

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-5305
https://wpscan.com/vulnerability/bf59610b-98ba-4c05-b2fc-85c163e9a389
https://github.com/advisories/GHSA-gcp6-956h-2589