Check & Log Email WordPress Plugin Unauthenticated Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Check & Log Email WordPress plugin, affecting versions prior to 2.0.13. The issue arises because the plugin does not properly manage email replacement, allowing unauthenticated users to inject malicious scripts when the email encoder setting is activated.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user who views the affected content.

Reproduction

To reproduce this vulnerability, log in as an administrator and navigate to the Check & Log Email plugin settings. Enable the 'Email Encoder' option and save the changes. Then, as an unauthenticated user, add a comment to any post containing a crafted email link with a JavaScript payload. Once the comment is approved, the payload will execute, demonstrating the cross-site scripting vulnerability.