The WordPress WP Mailster plugin contains an improper neutralization of input during web page generation flaw allowing an attacker to embed arbitrary JavaScript in a URL that is reflected back into the page without escaping. When a victim visits the crafted link, the injected script runs in the victim’s browser, potentially letting the attacker steal session cookies, manipulate the page, or redirect the user to malicious sites.

The vulnerability affects the WP Mailster plugin from brandtoss for WordPress. Every installation using version 1.8.17.0 or older is considered vulnerable; newer releases beyond 1.8.17.0 are not affected.

With a CVSS score of 7.1 the flaw presents moderate‑to‑high severity. The EPSS score of less than 1 % and absence from the CISA KEV catalog indicate a low probability of widespread exploitation at present. The attack can be performed simply by creating a malicious URL and delivering it to users, without requiring privileged access or advanced techniques. Successful exploitation would compromise the confidentiality and integrity of user sessions and site content.