The GD Mail Queue plugin fails to properly neutralize user‑supplied input when generating web pages, allowing reflected cross‑site scripting attacks. An attacker can craft a request that includes malicious code, which the plugin echoes without encoding. This can lead to session hijacking, cookie theft, or defacement of user accounts that visit the crafted URL, compromising both confidentiality and integrity of affected users.

Milan Petrovic’s GD Mail Queue plugin is affected. Any installation running version 4.3 or earlier is vulnerable. No specific sub‑version list is provided, but all releases through 4.3 are impacted.

The CVSS score of 7.1 indicates a high‑severity vulnerability, but the EPSS score of less than 1% shows a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a reflected XSS exploit triggered by a crafted URL or form input that the plugin reflects back to the page, typically targeting users who click on a malicious link or submit a form. If exploited, an attacker could steal session data or inject scripts into a user’s browser, creating a moderate to high risk to user accounts and site integrity.