CVE-2023-7070: 
WordPress vulnerability analysis and mitigation

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2023-7070) in versions up to and including 2.1.9. The vulnerability exists in the plugin's eeb_mailto shortcode due to insufficient input sanitization and output escaping on user supplied attributes (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4 (Medium) according to NIST, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L). The vulnerability stems from insufficient sanitization of user-supplied attributes in the eeb_mailto shortcode (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

Users should update to a version newer than 2.1.9 of the Email Encoder plugin to remediate this vulnerability. The issue has been patched in newer versions (NVD).