An attacker can supply crafted user input that is reflected in the web page without proper encoding, enabling the execution of arbitrary JavaScript within the victim’s browser. This reflected Cross‑site Scripting (XSS) flaw can be exploited to steal user credentials, hijack sessions, modify content, or deliver malware. The vulnerability resides in the WP IMAP Auth plugin for WordPress, specifically versions up to and including 4.0.1.

The affected product is the WP IMAP Auth plugin from imsoftware, a WordPress authentication extension. Versions from the initial release through 4.0.1 are impacted. Systems running an affected version remain vulnerable until the plugin is updated.

The CVSS score of 7.1 indicates a high severity; the EPSS score of < 1% suggests a very low probability of exploitation as of the last assessment. The flaw is not listed in the CISA KEV database. The likely attack vector is a web browser user who follows a crafted link or submits a malicious form request to the vulnerable plugin. Successful exploitation would allow an attacker to execute arbitrary script code in the context of any authenticated or unauthenticated user who views the affected page.