The vulnerability allows attackers to insert malicious code that is stored in the database and subsequently rendered in web pages for visitors. The plugin fails to neutralize user input, enabling arbitrary script execution within the site’s context, which can lead to theft of session cookies, page defacement, or redirection to malicious URLs. The likely attack vector is through the plugin’s input fields, a conclusion inferred from the description of stored XSS.

The affected product is the Rustaurius Ultimate WP Mail plugin for WordPress. Versions from the initial release through 1.3.8 inclusive are vulnerable; any WordPress installation that has the plugin installed or contains data originating from those versions is at risk.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests that exploitation attempts are uncommon. The vulnerability is not listed in the CISA KEV catalog. The description does not specify authentication or privilege requirements, so the exact prerequisite for exploiting the stored XSS is unknown. Once an attacker injects malicious payloads, they can persistently affect the web pages rendered for all site visitors, potentially enabling theft of session information, defacement, or redirection. No information in the description indicates a server‑side compromise is possible.