A reflected XSS flaw exists in the WP Mailster plugin for WordPress, allowing an attacker to inject malicious script into pages that are viewed by a victim. The weakness is a classic input‑validation failure (CWE‑79). An attacker can craft a specially‑crafted URL or form field that includes script code; when the application renders the content without proper encoding, the victim’s browser executes the code. This can lead to session hijacking, defacement or phishing attacks, and can compromise the confidentiality and integrity of the affected site. The vulnerability is limited to the plugin itself, not the core WordPress installation, but any user who logs in or visits pages affected by the plugin could be exploited.

The affected product is WP Mailster, a mail handling plugin for WordPress, developed by brandtoss. Versions up to and including 1.8.15.0 are vulnerable. No other products or vendors are listed as affected.

The CVSS score of 7.1 indicates a high‑risk vulnerability that likely permits remote exploitation via a crafted input. The EPSS score is less than 1%, suggesting that current exploit probability is low, and the issue is not listed in the CISA KEV catalog. The likely attack vector is through a web request containing malicious data, such as a URL parameter or form submission, that is reflected in the generated page without sanitization. The impact is limited to users interacting with the vulnerable plugin, but because it is a reflected XSS, the attack requires victim interaction and the user must load a malicious page.