The vulnerability is an improper neutralization of user input during web page generation, allowing a reflected DOM-based cross‑site scripting (XSS) attack. An attacker can inject arbitrary JavaScript into the page that displays post‑mail‑log data, potentially hijacking user sessions, exfiltrating data, or defacing the site. The impact is limited to the client side, but because the injected code runs in the victim’s browser, it can compromise authentication tokens or other client‑side state.

WPVibes WP Mail Log is affected for all versions from the initial release through 1.0.2. The plugin is a WordPress component that logs sent emails and presents that log through the web interface. No other vendors or product lines are listed as impacted.

The CVSS v3 score of 7.1 indicates a moderate to high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited. The likely attack vector is through user‑controlled parameters on the plugin’s log view page, where an unauthenticated or low‑privilege user can trigger the reflected XSS. Once triggered, the attacker can execute malicious scripts in the victim’s browser, but the vulnerability does not provide direct remote code execution on the server.