The WP Mailster plugin for WordPress contains an improper neutralization of user input during page generation, resulting in a reflected cross‑site scripting (XSS) vulnerability. A malicious user can craft input that is echoed back into the browser, allowing the execution of arbitrary client‑side script when a vulnerable page is rendered.

The defect affects the WP Mailster plugin (brandtoss:WP Mailster) in all releases up to and including version 1.8.20.0. Any WordPress website that has installed or activated the plugin at or below this version is exposed to the reflected XSS flaw.

The CVSS score of 7.1 classifies the vulnerability as high, reflecting the potential for client‑side code execution with minimal effort. The EPSS score of <1% signals a low probability of widespread exploitation at present, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request that supplies the malicious input, making the risk real for sites that expose the plugin’s endpoints to unauthenticated or privileged users.