The vulnerability is an improper neutralization of input during web page generation that allows an attacker to reflect malicious JavaScript onto web pages served by WordPress sites using EmailPress plugin version 1.0 or earlier. This vulnerability is identified as CWE‑79 Cross‑Site Scripting. The reflected XSS flaw would let an attacker execute arbitrary client‑side code in the context of the victim’s browser session, potentially stealing session cookies, defacing content, or performing further phishing attacks.

WordPress sites that have the kvvaradha EmailPress plugin installed at version 1.0 or lower are impacted. No other versions or WordPress components are listed as affected.

The CVSS score of 7.1 indicates a moderate to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is inferred to be web‑based, whereby an attacker crafts a malicious URL or inputs that trigger the plugin to echo back unsanitized data, allowing the reflected script to run in the user’s browser.