The EmailShroud plugin suffers from a Cross‑Site Request Forgery flaw that permits an attacker to cause an authenticated WordPress user to visit a specially crafted link, injecting arbitrary script into the page. This injected script is mirrored in the response, creating a reflected XSS condition that can steal session cookies, hijack the user session, or display malicious content. The weakness is classified as CWE‑352.

All installations of Oddthinking’s EmailShroud plug‑in running any version up to and including 2.2.1 are vulnerable. The vulnerability applies to every WordPress site that has this plug‑in installed within that version range.

The CVSS score of 7.1 indicates moderate severity. The EPSS score is below 1%, pointing to a very low probability of exploitation as of this assessment. The vulnerability is not listed in the CISA KEV catalog. Attack requires a legitimate authenticated WordPress user to follow a malicious URL. Based on the description, it is inferred that the attacker must rely on social engineering or phishing to trick the user into opening the crafted link. No higher privilege or additional system compromise is necessary.