The vulnerability is a stored Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into pages generated by the Email Notification on Login plugin. When exploited, the script runs in the context of the site, potentially enabling session hijacking, defacement, or unauthorized data exfiltration. This weakness stems from improper input sanitization (CWE‑79) during web page generation.

Affected systems are WordPress installations that have the Email Notification on Login plugin from the vendor apasionados installed. All released versions up to and including 1.7.0 are vulnerable.

The CVSS score of 5.9 indicates a medium severity impact. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a web‑based one where a malicious payload is entered into a field processed by the plugin, such as an email template or notification message. The attacker only needs the plugin to be active on a WordPress site, and the vulnerability does not require pre‑existing authentication, making it exploitable by both authenticated and unauthenticated users.