A Cross‑Site Request Forgery flaw in the Zoho ZeptoMail WordPress plugin permits an attacker to inject malicious scripts that are stored on the site. The stored XSS can execute in the browsers of anyone who views the impacted content, potentially allowing attackers to hijack sessions, deface the site, or exfiltrate data. This weakness falls under CWE‑352.

The vulnerability exists in all releases of the Zoho ZeptoMail plugin up to and including version 3.3.1, regardless of when the plugin was first installed. It is deployed on WordPress sites that use Zoho Mail for email transmission.

The CVSS score of 7.1 indicates moderate to high impact, while the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. The flaw is not listed in the CISA KEV catalog. The likely attack path would involve a victim’s browser being tricked into submitting a forged request that embeds attacker‑controlled script, which the plugin then stores and later renders without proper sanitization. Because the CVE description does not disclose an authentication requirement, it is inferred that the attack could occur even against unauthenticated visitors if the plugin accepts unchecked input from any user.