The vulnerability arises from improper neutralization of user input during web page generation, enabling stored XSS in the WordPress Mail Subscribe List plugin. A malicious payload entered via the subscription form can be persisted and executed in other users’ browsers, potentially compromising session data, defacing content, or redirecting users. This weakness aligns with CWE‑79, indicating insecure handling of untrusted data.

The Mail Subscribe List plugin developed by Richard Leishman is affected. Any installation of versions from the initial release up to and including 2.1.10 is vulnerable, regardless of the exact minor build number.

The CVSS score of 6.5 denotes moderate severity. With an EPSS score below 1%, the likelihood of public exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be any user who can submit the subscription form, allowing the attacker to inject and store malicious scripts that will be served to all subsequent visitors.