The vulnerability allows authenticated users with contributor-level privileges to inject arbitrary scripts into the 'mailgun_subscription_form' shortcode via unsanitized attributes. This stored XSS means the malicious code persists in the database and will execute whenever any user views a page that renders the shortcode, potentially leading to theft of session cookies, defacement, or the execution of further malicious actions. The weakness is a classic input validation flaw (CWE‑79) and can compromise any site that has deployed the affected plugin.

The WordPress plugin Mailgun Subscriptions, versions 1.3.1 and earlier, is affected. Any site running the plugin with contributor or higher access should consider upgrading or disabling the affected functionality.

The CVSS v3.1 score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests that real‑world exploitation is currently rare, and the plugin is not listed in CISA’s KEV catalog. Because the attack requires authenticated contributor access and the ability to embed the form shortcode, the risk is confined to privileged users within a single WordPress installation, but the impact can be significant if an attacker controls a contributor account.