An improper neutralization of input in the Postie plugin allows a stored cross‑site scripting flaw. Malicious payloads that are submitted through the plugin can be stored and later rendered in web pages, enabling an attacker to execute arbitrary code in the browser of any user who views the affected content.

The vulnerability affects the Postie plugin authored by Wayne Allen, versions up to and including 1.9.73. No other WordPress core or plugins are listed as affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation at present. The flaw is not part of the CISA KEV catalogue. Based on the description, the likely attack vector involves submitting or editing content through the plugin’s form or email interface, which is then rendered in WordPress posts or pages. Exploitation would allow attacker‑controlled JavaScript to run in the context of users who view the compromised content, but the success depends on the attacker’s ability to provide input to the plugin and on users accessing the stored content.