The Solid Mail plugin for WordPress stores arbitrary web scripts when an attacker supplies malicious content in the email name, subject, or body fields. Because the input is not sanitised or escaped, any user who later views the stored email content will have the injected script executed in their browser. The impact is the execution of the attacker's script in the victim's browser; such scripts could potentially allow the attacker to steal session cookies, deface the site, or redirect users to malicious sites—these uses are inferred from typical XSS behaviour and are not explicitly stated in the CVE description.

All installations of the Solid Mail – SMTP email and logging plugin by SolidWP that are version 2.1.5 or earlier are affected. The flaw resides in the core email handling code and is present regardless of other configuration settings.

The CVSS score of 7.2 indicates a medium‑to‑high severity, while the EPSS score of less than 1% suggests that active exploitation in the wild is currently rare. The vulnerability is not included in the CISA KEV catalog. An unauthenticated attacker can reach the flaw through the public SMTP/email form provided by the plugin, send a crafted message containing malicious JavaScript, and later trigger its execution when any site visitor opens the email page. The lack of immediate exploitation evidence does not diminish the potential damage if the vulnerability were to be leveraged or if an attacker gains the capability to target the site.