The Nonaki email template builder plugin contains a stored XSS vulnerability that allows authenticated contributors to inject malicious scripts via custom field values rendered by the "nonaki" shortcode. The flaw derives from insufficient input filtering and output escaping, enabling arbitrary JavaScript to run in the context of any page that displays the malicious content. Attackers could thus perform session hijacking, defacement, or phishing within affected sites.

All installations of the Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress up to and including version 1.0.11 are vulnerable. WordPress sites that have granted contributors or higher roles the ability to create or edit these templates are at risk.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of <1% suggests that exploitation probability remains low but nonzero. The vulnerability is not listed in CISA's KEV catalog. An attacker must first authenticate with at least contributor privileges, after which they can inject scripts that will execute for any visitor accessing the infected page. Because the flaw is stored and triggered simply by page view, once compromised, the impact can affect all site users.