The vulnerability is an instance of Stored Cross‑Site Scripting (XSS) where unfiltered user input is rendered in a web page without proper encoding. This flaw allows an attacker to inject malicious scripts that will execute when any user views the affected page. The consequence is that the attacker can steal session cookies, deface content, redirect users, or conduct further attacks such as phishing or botnet control. The weakness is classified as CWE‑79.

The issue affects the WordPress plugin SendPulse Email Marketing Newsletter, specifically all released versions up to and including 2.1.6. Users running any of these earlier releases are vulnerable and should verify the plugin version and apply remediation.

The CVSS score of 6.5 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Nonetheless, an attacker could exploit the flaw by sending a crafted payload through the plugin’s input fields, which the plugin stores and later returns in a page view, resulting in script execution in the victim’s browser. The attack vector is web‑based and requires access to the WordPress administration interface or at least to any user who can trigger the affected pages.