CVE-2024-7083

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-7083", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-07-24T16:55:36.785Z", "datePublished": "2026-04-20T06:00:07.030Z", "dateUpdated": "2026-04-20T13:16:26.285Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-20T06:00:07.030Z"}, "title": "Email Encoder < 2.3.4 - Admin+ Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Email Encoder", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.3.4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}], "references": [{"url": "https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Dmitrii Ignatyev", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T13:15:55.337834Z", "id": "CVE-2024-7083", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:16:26.285Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-7083", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:15:55.337834Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:16:21.247Z"}}], "cna": {"title": "Email Encoder < 2.3.4 - Admin+ Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Email Encoder", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-20T06:00:07.030Z"}}}, "cveMetadata": {"cveId": "CVE-2024-7083", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:16:26.285Z", "dateReserved": "2024-07-24T16:55:36.785Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-04-20T06:00:07.030Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Email Encoder", "vendor": "Unknown", "versions": [{"lessThan": "2.3.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}, {"lang": "es", "value": "El plugin de WordPress Email Encoder anterior a 2.3.4 no sanea ni escapa algunas de sus configuraciones, lo que podr\u00eda permitir a usuarios con altos privilegios, como administradores, realizar ataques de cross-site scripting almacenado incluso cuando la capacidad unfiltered_html est\u00e1 deshabilitada (por ejemplo, en una configuraci\u00f3n multisitio)."}], "id": "CVE-2024-7083", "lastModified": "2026-10-27T18:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-7083", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T13:15:55.337834Z", "version": "2.0.3"}}]}, "published": "2026-04-20T07:16:14.707", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "original": {"product": "Email Encoder", "source": "cna", "vendor": "Unknown"}, "product": "email_encoder", "vendor": "email_encoder"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-20T15:25:24.512006+00:00", "value": {"mitigation_remediation": ["Upgrade the Email Encoder plugin to version 2.3.4 or later.", "If an upgrade is not immediately possible, restrict administrative access to the plugin\u2019s settings or block the vulnerable settings pages until a patch can be applied.", "Enable site\u2011wide XSS filtering and carefully audit any script outputs generated by the plugin, ensuring they are properly escaped before rendering."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that uses the Email Encoder plugin with a version earlier than 2.3.4 is affected. The issue applies regardless of whether the unfiltered_html capability is enabled, meaning multisite setups and other configurations that restrict unfiltered_html are still vulnerable to this Stored XSS attack.", "description_and_impact": "The WordPress plugin Email Encoder releases settings that are not sanitized or escaped, allowing administrators to embed malicious scripts that will be persisted and served to other users. Attackers with administrative privileges can exploit this flaw to inject JavaScript into the site, potentially hijacking user sessions, defacing content, or leaking sensitive data. The weakness is a classic case of CWE\u201179, improper neutralization of input during web page generation.", "risk_and_exploitability": "The vulnerability can be exploited by logging in as an administrator and inserting a crafted setting value that persists as a script. Since stored XSS affects all users who view the affected page, the impact is wide. The CVSS score is 3.5 and the EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog, but the potential for widespread cross\u2011site script execution makes it a high\u2011risk concern. The likely attack vector is via authenticated access to the plugin\u2019s administrative interface."}}}}, "created": "2026-04-20T08:30:02.623974+00:00", "updated": "2026-04-20T15:30:06.170111+00:00", "vendors": ["email_encoder", "email_encoder$PRODUCT$email_encoder", "wordpress", "wordpress$PRODUCT$wordpress"], "weaknesses": ["CWE-79"]}