The Easy Email Subscription plugin for WordPress stores user-supplied data in the 'name' field without sanitizing or escaping it, creating a stored cross‑site scripting weakness. An unauthenticated attacker can submit arbitrary JavaScript via that field, which will run in any visitor’s browser when the stored data is displayed. This classic input validation flaw (CWE‑79) can be leveraged to hijack sessions, deface content, or launch phishing attacks and therefore strongly impacts confidentiality and integrity of site users.

All builds of the Easy Email Subscription plugin, from its initial release through version 1.3, are vulnerable. The plugin is released by the WordPress community under the vendor yudiz and is available as a WordPress plugin. Any WordPress site using this plugin in a version up to and including 1.3 is affected, while newer releases are not known to contain the flaw.

The CVSS v3.1 score of 7.2 indicates a high potential impact on site visitors, yet the EPSS score of less than 1% reflects a low current likelihood of exploitation in the wild. Because the vulnerability is triggered via an unauthenticated public web interface, any publicly accessible WordPress installation that hosts the affected plugin can be targeted. Although it is not yet listed in the CISA KEV catalog, the severity of the stored XSS warrants prompt remediation.