This vulnerability originates from the BP Email Assign Templates plugin, which does not properly neutralize user input when rendering web pages, allowing attackers to inject malicious scripts into reflected responses. The flaw permits the execution of arbitrary client‑side code with the privileges of the victim browser. The weakness is classified as a Reflected Cross‑Site Scripting (CWE‑79).

WordPress sites running shanebp’s BP Email Assign Templates plugin, versions up to and including 1.5, are impacted.

The CVSS base score of 7.1 indicates a high risk, with the potential for attackers to exploit this flaw via a crafted URL or form submission that is reflected back to the victim's browser. Because the EPSS score is below 1 %, the probability of observed exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack surface remains significant for sites that expose the affected plugin, and the vulnerability can be leveraged remotely by any user who can trigger the templating functionality.