The BP Email Assign Templates plugin for WordPress, developed by shanebp, contains a stored cross‑site scripting flaw due to improper neutralization of user input during web page generation. An attacker can place malicious JavaScript code in an email template that is saved by the plugin and later rendered to users, enabling script execution in their browsers. The vulnerability is a classic XSS weakness (CWE‑79) and can compromise confidentiality, integrity, or availability of the affected site depending on the attacker’s intent.

Any WordPress installation that uses the BP Email Assign Templates plugin from shanebp, version 1.6 or earlier, is vulnerable. The flaw exists in all releases up to and including 1.6; newer releases are not documented as affected.

The CVSS score of 5.9 reflects moderate severity, while the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation. This issue is not listed in the CISA KEV catalog. Attackers could exploit the flaw by creating or editing an email template that contains malicious JavaScript; when the template content is viewed by any site user, the payload runs in their browser, potentially enabling session hijacking, defacement, or cookie theft. The likely attack vector is through the plugin’s template creation interface, which fails to sanitize input before storing it.