Email Encoder – Protect Email Addresses and Phone Numbers
Email Encoder – Protect Email Addresses and Phone Numbers has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 10 of the records (100%).
Every one of the 10 issues recorded for Email Encoder – Protect Email Addresses and Phone Numbers has a vendor fix available, so running the current release closes all known holes.
10 independent researchers contributed these findings, one record each. Email Encoder – Protect Email Addresses and Phone Numbers is installed on roughly 90,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-5776Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Email Encoder – Protect Email Addresses and Phone Numbers
Author
Online Optimisation
Full site protection for your email addresses from spam-bots, email harvesters and other robots. No configuration needed. It also protects phone numbers or any other text using our integrated [eeb_protect_content] shortcode or href attribute encoding. Features Full page protection for all of your emails Instant results (No confiruation needed) Protects mailto links, plain emails, email input fields, RSS feeds and much more Protect phone number links, ftp, skype, file and other custom link attributes Autmoatic protection technique detection (Our plugin chooses automatically the best protection technique for each email) Exclude posts and pages from protection Automatically convert plain emails to mailto-links Automatically convert plain emails to png images Supports rot13 encoing, escape encoding, CSS directions, entity encoding and much more Deactivate CSS directions manually for browser backwards compatibility Shortcode support: [eeb_protect_emails], [eeb_protect_content], [eeb_mailto], [eeb_form] Template tag support: eeb_protect_emails(), eeb_protect_content(), eeb_mailto(), eeb_form() Protect phone numbers (or any text or html) Also supports special chars, like é, â, ö, Chinese characters etcetera Use the Encoder Form to manually create encoded scripts Compatibilities The plugin works with mostly any theme and plugin. Some special ones need special treatment. Down below you can learn more about that. Compatible with the Maintenance plugin from WP Maintenance Divi Theme is fully integrated as well Jetpack Image carousel is compatible as well Free Website Check We offer you a free tool to test if your website contains unprotected emails. You can use our website checker by clicking here Easy to use After activating the plugin all email addresses on your website will be protected out-of-the-box. We also offer custom shortcodes and template functions to protect phone numbers or other text. Support Documentation – After plugin activation, check the help tab on the plugin options page Documentation on wpemailencoder.com FAQ Like this plugin? Please Review it Credits Adam Hunter for the encode method ‘JavaScript Escape’ which is taken from his plugin Email Spam Protection Tyler Akins for the encode method ‘JavaScript ASCII Mixer’ Title icon on Admin Options Page was made by Jack Cai
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C