CVE-2023-47821

MediumCVSS 6.5

Published: 22/11/2023(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

The Email Encoder plugin for WordPress by Jannis Thuemmig in version 2.1.8 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

Risk Assessment

An attacker can inject a malicious script that executes in the administrator's browser, leading to session theft or other actions.

Recommendation

Update the Email Encoder plugin to the latest available version.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.