CVE-2026-5305

Name of the Vulnerable Software and Affected Versions Email Address Encoder versions prior to 1.0.25 email-encoder-premium versions prior to 0.3.12

Description Improper handling of email replacement allows unauthenticated users to perform Stored Cross-Site Scripting (XSS) attacks. This issue occurs due to unsafe handling of email replacement output and improper input validation or output encoding, which allows attacker-controlled content to be persisted and rendered as a script. An attacker can remotely inject crafted payloads during the email replacement process that are later served to visitors or administrators. This can lead to arbitrary JavaScript execution in the victim's browser, potentially resulting in administrative session hijacking, malicious redirects, and site takeover.

Recommendations Update Email Address Encoder to version 1.0.25. Update email-encoder-premium to version 0.3.12.