An improper neutralization of input during web page generation creates a reflected XSS vulnerability. When user‑controlled data is echoed back into the page without proper escaping, an attacker can inject malicious scripts that execute in the victim’s browser. The CVE description only specifies the reflected XSS and does not document additional consequences such as confidential information theft or credential compromise.

WordPress sites running the SCAND MultiMailer plugin version 1.0.3 or earlier are affected. This includes any installations that have not upgraded beyond the stated version threshold.

The CVSS score of 7.1 places this vulnerability in the High severity category, indicating a significant potential impact if exploited. The EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve a reflected XSS via manipulated GET or POST parameters that the plugin incorporates into dynamically generated pages, although the CVE description does not explicitly detail the attack path.