The vulnerability is an Improper Neutralization of Input during Web Page Generation that allows an attacker to inject malicious JavaScript into a WordPress page via the turboSMTP plugin. Because the input is reflected directly in the response, a crafted URL can trigger script execution in the context of any user who visits it, potentially leading to session hijacking, credential theft, defacement or the delivery of malware. The weakness is identified as Cross‑Site Scripting (CWE‑79).

All WordPress installations that use the turboSMTP plugin version 4.6 or earlier are affected. The vulnerability exists in all releases from the inception of the plugin up to and including version 4.6.

The CVSS score of 7.1 indicates a high impact potential, while the EPSS score of less than 1% suggests that, so far, real‑world exploitation is low but not negligible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to embed malicious input in a URL that will be rendered by the plugin, making the attack surface available to anyone who follows a link—either a targeted user or an arbitrary visitor depending on the site’s traffic exposure. Given the sensitivity of XSS to user input handling, the risk is significant for exposed, public endpoints.