CVE-2026-10091: Email JavaScript Cloak XSS Vulnerability

CVE-2026-10091 Overview

CVE-2026-10091 is a Stored Cross-Site Scripting (XSS) vulnerability in the Email JavaScript Cloak plugin for WordPress. The flaw affects all versions up to and including 1.03. It resides in the plugin's email shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses the affected page. The issue is tracked under [CWE-79].

Critical Impact
Authenticated contributors can persist arbitrary JavaScript on rendered pages, enabling session theft, redirect attacks, and unauthorized actions in the browser context of site visitors and administrators.

Affected Products

Email JavaScript Cloak plugin for WordPress, versions up to and including 1.03
WordPress sites permitting contributor-level (or higher) accounts
Pages and posts rendering the plugin's email shortcode

Discovery Timeline

2026-06-24 - CVE-2026-10091 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-10091

Vulnerability Analysis

The Email JavaScript Cloak plugin provides an email shortcode that obfuscates email addresses using JavaScript. The shortcode accepts user-controlled attributes and embeds them into the rendered HTML output. The plugin does not sanitize these attributes on input and does not escape them on output. As a result, attribute values supplied through post or page content flow directly into the page's HTML and JavaScript context.

Any WordPress user with contributor privileges or above can insert the shortcode with malicious attribute values into a post. When the post is previewed or published and later viewed, the injected payload executes in the visitor's browser. Because the payload is stored in the database and served on every page load, the impact extends beyond a single victim. The vulnerability is exploitable over the network with low attack complexity.

Root Cause

The root cause is missing input sanitization and missing output escaping within the shortcode handler. According to the plugin source references at lines 45 and 68 of email-js-cloak.php, attribute values are concatenated into the output without applying WordPress escaping functions such as esc_attr(), esc_html(), or esc_js(). This omission violates the WordPress secure coding guidance for shortcode attributes.

Attack Vector

An attacker authenticates to WordPress with a contributor or higher role. The attacker creates a draft post containing the email shortcode with a crafted attribute carrying a JavaScript payload. After submission, when an editor reviews the draft or any user visits the published page, the payload executes. The script runs with the privileges of the viewing user, which may include administrators. Refer to the Wordfence Vulnerability Report for additional technical context.

// No verified exploit code available.
// See Wordfence and plugin source references for technical details.

Detection Methods for CVE-2026-10091

Indicators of Compromise

Post or page content containing the [email ...] shortcode with attributes embedding <script>, onerror, onload, or javascript: strings.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after viewing pages that include the plugin's shortcode.
New or modified posts authored by contributor-level accounts that include the plugin's shortcode.
WordPress audit log entries showing shortcode attribute values containing HTML or JavaScript syntax.

Detection Strategies

Query the wp_posts table for post_content matching the email shortcode pattern and inspect attribute values for script tags or event handlers.
Deploy a Web Application Firewall (WAF) rule that inspects POST requests to wp-admin/post.php for shortcode attributes containing JavaScript syntax.
Use Content Security Policy (CSP) violation reports to surface inline script execution on pages rendering the plugin shortcode.
Monitor browser-side telemetry for script execution originating from page contexts that should not contain inline JavaScript.

Monitoring Recommendations

Alert on contributor or author accounts publishing or updating posts containing shortcode attributes with angle brackets, quotes, or event handler keywords.
Track plugin version inventory across managed WordPress instances to identify hosts running Email JavaScript Cloak 1.03 or earlier.
Forward WordPress access and audit logs to a centralized SIEM and correlate authentication events with post creation activity from low-privilege roles.

How to Mitigate CVE-2026-10091

Immediate Actions Required

Deactivate the Email JavaScript Cloak plugin on all WordPress sites until a fixed version is available.
Audit existing posts and pages for the email shortcode and review attribute values for injected scripts.
Restrict contributor and author account creation, and review existing low-privilege accounts for unexpected activity.
Enforce a strong Content Security Policy that blocks inline script execution where feasible.

Patch Information

No patched version has been published in the referenced advisory data at the time of disclosure. Versions up to and including 1.03 remain vulnerable. Monitor the WordPress Plugin Source Code repository and the Wordfence Vulnerability Report for updates and apply the vendor patch as soon as it is released.

Workarounds

Remove the plugin entirely if the email cloaking functionality is not essential.
Limit the use of shortcodes in posts by restricting contributor roles via a capability management plugin.
Require editor or administrator review of all contributor submissions before publication and inspect shortcode attributes during review.
Deploy a WAF rule that strips or blocks HTML and JavaScript syntax within shortcode attribute values.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate email-javascript-cloaker
wp plugin delete email-javascript-cloaker

# Search for the shortcode in existing content
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[email %' AND post_status IN ('publish','draft','pending');"