The Email Encoder WordPress plugin prior to version 2.3.4 fails to sanitize and escape certain settings, enabling stored Cross-Site Scripting (CWE-79) attacks. This affects high privilege users, including admins, who can inject malicious scripts despite restrictions like disabled unfiltered_html capability. The vulnerability is documented as CVE-2024-7083 but lacks a CVSS score and official remediation details. It is not a cloud service, and no known active exploits have been reported.

Successful exploitation allows high privilege users to perform stored XSS attacks, potentially leading to script execution in the context of other users or administrators. This could facilitate actions such as session hijacking or unauthorized actions within the WordPress admin interface. However, exploitation requires administrative privileges, limiting the scope to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor plugin updates for a security patch. Avoid using vulnerable versions of the Email Encoder plugin in environments where high privilege user accounts may be exposed.