The WPLG Default Mail From plugin for WordPress contains a reflected Cross‑Site Scripting flaw caused by the use of the $_SERVER['PHP_SELF'] variable without proper sanitization or escaping. When a user visits a crafted URL, the value of PHP_SELF is reflected back into the page, allowing an attacker to inject and execute JavaScript within the victim’s browser context. This vulnerability permits only client‑side code execution and does not provide direct access to the server or the WordPress site.

WordPress installations that have the WPLG Default Mail From plugin by wpletsgo running any version up to and including 1.0.0 are affected. Sites using a newer version or not using the plugin are not vulnerable.

The CVSS score of 6.1 classifies the flaw as moderate severity. The EPSS score of less than 1% indicates a low current likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack requires an unauthenticated attacker to persuade a victim to click a specially crafted link that contains the unsanitized PHP_SELF value; if successful, the injected script executes in the victim’s browser. Because the exploit is purely client‑side, it can be mitigated by addressing the root XSS flaw, but the potential for user harm remains until remediation is deployed.