The Site Mailer plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient input sanitization and output escaping. An attacker can inject arbitrary JavaScript into a stored entry, which is then rendered on every page that references that entry. The injected script runs in the browser context of any user who visits the compromised page, allowing theft of session cookies, defacement, or phishing.

Current WordPress sites that use Elementor’s Site Mailer plugin – SMTP Replacement, Email API Deliverability & Email Log – are affected if they run version 1.2.3 or any earlier release. Versions newer than 1.2.3 are not impacted as they contain the fix.

The CVSS score of 7.2 indicates a medium‑to‑high severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered by an unauthenticated attacker via the plugin’s settings interface, the attack surface is widely exposed, although the attacker must be able to submit data that will be stored and rendered.