The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw that allows an attacker to trigger the plugin to store arbitrary JavaScript code in the WordPress site. Once the code is stored, regular visitors to the site can be subjected to a Stored XSS attack, enabling the attacker to execute malicious scripts in the context of the user’s browser. This can lead to session hijacking, credential theft, or other client‑side exploits.

Free MailClient FMC plugin for WordPress, released by cstoltenkamp, is affected in all versions through 1.0. Users running this plugin on their sites should check whether they are using a vulnerable version and consider upgrading if a newer release exists.

The CVSS score of 7.1 classifies the flaw as high severity, indicating significant potential damage. The EPSS score of less than 1% suggests that, as of the latest measurement, the likelihood of a real‑world exploit is low. The vulnerability is not listed in the CISA KEV catalog, which means known exploits are not publicly documented. Based on the description, the likely attack vector is a web‑based CSRF request that an attacker can craft to inject the malicious code, which then becomes stored in the site’s database and delivered to unsuspecting users.