WP Mailto Links – Protect Email Addresses
WP Mailto Links – Protect Email Addresses has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. WP Mailto Links – Protect Email Addresses is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.
CVE-2025-53464WP Mailto Links <= 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WP Mailto Links – Protect Email Addresses
Author
Online Optimisation
Protect and encode email addresses safely from spambots, spamming and other robots. Easy to use out-of-the-box without any configuration. Features Full page protection for emails Instant results (No confiruation needed) Protects mailto links, plain emails, email input fields, RSS feeds and much more Autmoatic protection technique detection (Our plugin chooses automatically the best protection technique for each email) Exclude posts and pages from protection Automatically convert plain emails to mailto-links Automatically convert plain emails to png images Supports rot13 encoing, escape encoding, CSS directions, entity encoding and much more Deactivate CSS directions manually for backwards compatibility Shortcode support: [wpml_mailto] Template tag support: wpml_mailto() and wpml_filter() The plugin combines the best email protection methods (CSS, PHP and JavaScript techniques). Free Website Check We offer you a free tool to test if your website contains unprotected emails. You can use our website checker by clicking here Easy to use The plugin works out-of-the-box to protect your email addresses. After activating the plugin, all options are already set for protecting your emails and mailto links. Documentation The plugin works out-of-the-box to protect your email addresses. All settings are default set to protect your email addresses automatically with the best method available. If you want to manually create protected mailto links, just use the shortcode ([wpml_mailto]) within your posts or use the template tags (wpml_mailto() or wpml_filter()) in your theme files. Shortcode `[wpml_mailto email=”…”]…[/wpml_mailto]` Create a protected mailto link in your posts: [wpml_mailto email=”info@myemail.com”]My Email[/wpml_mailto] It’s also possible to add attributes to the mailto link, like a target: [wpml_mailto email=”info@myemail.com” target=”_blank”]My Email[/wpml_mailto] Shortcode `[wpmt_protect]…[/wpmt_protect]` Protect content using our plugin that is not encodedby default (E.g. some ajax loaded values): [wpmt_protect]YOUR CONTENT YOU WANT TO CHECK FOR EMAILS[/wpmt_protect] It’s also possible to customize the encoding type using “protect_using”. Possible values: char_encode, strong_method, without_javascript, with_javascript: [wpmt_protect protect_using=”…”]YOUR CONTENT YOU WANT TO CHECK FOR EMAILS[/wpmt_protect] Template tag `wpml_mailto( $email [, $display] [, $attrs] )` Create a protected mailto link in your template like: Template tag `wpml_filter( $content )` Filter given content to protect mailto links, shortcodes and plain emails (according to the settings in admin):
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C