CVE-2026-10091

Name of the Vulnerable Software and Affected Versions Email JavaScript Cloak versions prior to 1.04

Description The Email JavaScript Cloak plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping on user-supplied attributes within the 'email' shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.03.