The DeBounce Email Validator plugin for WordPress allows a stored cross‑site scripting flaw caused by improper neutralization of input during web page generation. When a user submits data through the plugin’s interface, any malicious script can be persisted and later rendered on the site, enabling attackers to execute arbitrary JavaScript in the context of the site’s users or administrators.

WordPress sites that run the DeBounce Email Validator plugin version 5.7.1 or earlier are vulnerable. Any installation that has not upgraded beyond 5.7.1 faces this risk.

The vulnerability has a CVSS score of 7.1, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation at present. The issue is not yet listed in CISA’s KEV catalog. Attackers can use the exposed form to inject script, and because the payload is stored, it remains available until an administrator removes or updates the content. The likely attack vector is a CSRF‑based request that pre‑populates the form with malicious code, allowing any user with permissions to submit the form to store the payload. Until a patch is applied, the flaw could be exploited by anyone with access to the form or via such a CSRF attack.