The SiteGround Email Marketing plugin allows stored XSS due to improper neutralisation of user input when generating web pages. An attacker can inject malicious JavaScript that is persisted in the plugin’s database and executed whenever a victim loads a page that includes the affected content. The impact includes the potential for session hijacking, data theft, defacement, and the spread of malware to site visitors.

All WordPress sites that have installed SiteGround Email Marketing version 1.7.1 or earlier are affected. The plugin is distributed by SiteGround as part of WordPress installations and does not affect the core WordPress software itself.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score of < 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is through the plugin’s administrative interface, where users can submit data that is later rendered without proper sanitisation. If an attacker can write to the plugin’s storage, any other user who visits the generated page will execute the injected script.