The Email on Publish plugin includes a Cross‑Site Request Forgery vulnerability that allows an attacker to inject and store malicious scripts. The vulnerability is exploited by forging a request that the plugin processes, resulting in a stored XSS that can execute in the browser context of users who view the infected content. The stored nature means the malicious payload persists until removed. This type of flaw can compromise confidentiality, integrity, or availability depending on the victim’s role, and it is mapped to CWE‑352.

The flaw affects all versions of the Email on Publish plugin by dkukral up through 1.5. Sites running WordPress with any of these plugin versions are at risk. No specific operating system or WordPress version is mentioned, so any installation of these plugin versions is impacted.

The CVSS score is 7.1, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely to need access to a crafted CSRF request, perhaps via social engineering or compromised user sessions. Once a victim processes the forged request, the stored script can trigger when the content is rendered, potentially impacting any user who views it.