The Mailing Group Listserv plugin for WordPress contains an improper neutralization of user controlled input. A crafted request can include malicious JavaScript that the plugin renders without encoding, giving attackers the ability to inject scripts into the page that visitors load. This reflected XSS can lead to session hijacking, cookie theft, defacement or installation of malware, affecting confidentiality, integrity and availability of the site.

The producer of the plugin is Yamna Khawaja, and the product is the WordPress Mailing Group Listserv plugin. Versions up to and including 2.0.9 are affected; no higher version is disclosed here.

The vulnerability is scored 7.1 on CVSS, indicating moderate to high severity. The EPSS score is below 1%, meaning the likelihood of public exploitation at the moment is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely a web request to the plugin's input handling code, targeting any user who visits a crafted URL. Successful exploitation requires that a victim load the vulnerable page, after which the injected script runs in the victim's browser, revealing the potential for a range of XSS‑based attacks.