The vulnerability allows an attacker to insert malicious script code that will be stored within the WordPress site and executed when users view affected pages, leading to potential defacement, session hijacking, or data exfiltration. It is a classic input validation flaw (CWE-79) whereby the plugin fails to neutralize user‑supplied data before rendering it on a webpage.

WordPress sites running Pixeline's Email Protector plugin, versions from the earliest available through 1.3.8. All sites that have not upgraded beyond version 1.3.8 are vulnerable.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. The vulnerability is not in the CISA KEV catalog. Based on the stored‑XSS nature, the attack vector likely involves injecting payloads into plugin‑managed content or settings fields that are later rendered without sanitization, requiring the attacker to be able to submit data to the site’s administrative interface or exploit a user‑submitted form.