The Check & Log Email WordPress plugin prior to version 2.0.13 contains a stored XSS vulnerability (CWE-79) due to improper sanitization of email replacement data when the email encoder setting is enabled. This flaw allows unauthenticated attackers to inject and store malicious scripts that can execute in the context of users viewing affected content. The vulnerability is publicly disclosed but lacks an assigned CVSS score and no official remediation guidance or patch links have been provided yet.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary scripts in the browsers of users interacting with the plugin's output, potentially leading to session hijacking, defacement, or other client-side attacks. However, no known exploits have been reported in the wild, and the impact depends on the plugin's deployment and usage context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the email encoder setting or limiting plugin usage to trusted users only to reduce exposure.