This vulnerability permits an attacker to submit a forged request that injects malicious JavaScript into the Free WP Mail SMTP plugin’s configuration, causing the script to be stored and executed for every visitor of the site. The stored XSS can result in session hijacking, credential theft, site defacement, and potentially serve as a foothold for further compromise. The weakness is identified as a Cross‑Site Request Forgery that is utilized to perform the injection.

WordPress sites using the Free WP Mail SMTP (mail250) plugin version 1.0 or earlier are affected. Any instance of the plugin that has not been upgraded beyond 1.0 remains vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% reflects a very low but nonzero probability that the flaw will be exploited in the wild. This vulnerability is not listed in the KEV catalog. Exploitation requires a CSRF request that the plugin accepts and stores; an attacker must either be able to forge such a request from an authenticated session or target users who are already logged into the site and have the necessary privileges to alter the plugin’s configuration. The stored payload would then run in the context of any visitor to the site, enabling the attacker to perform client‑side attacks.