Email Address Encoder
Email Address Encoder has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).
Every one of the 3 issues recorded for Email Address Encoder has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Email Address Encoder is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-5305Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Email Address Encoder
Author
Till Krüss
A lightweight plugin that protects plain email addresses and mailto links from email-harvesting robots, by encoding them into decimal and hexadecimal entities. Has an effect on the posts, pages, comments, excerpts, text widgets and other filtered content. Works without JavaScript — just simple spam protection. To see whether all your email addresses are properly protected, use the free page scanner tool. Other content (like phone numbers) can be protected using [encode] shortcode: [encode]+1 (555) 123-4567[/encode] [encode link="tel:+15551234567"]+1 (555) 123-4567[/encode] Premium Features Full-page protection that catches all email addresses Hardened protection using JavaScript and CSS techniques Improved phone number protection Built-in plugin support for ACF, Jetpack, WooCommerce and many others Check out the Premium version of Email Address Encoder.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C