This vulnerability is an instance of Improper Neutralization of Input During Web Page Generation, classified as CWE‑79. It allows attackers to inject arbitrary HTML or JavaScript that is reflected back to the victim’s browser. Consequently, a compromised user could execute malicious code in the context of the site, leading to cookie theft, session hijacking, defacement, or the execution of further attacks toward other users. The issue is a reflected XSS, meaning that the attacker does not need to depend on stored data and can target any user who visits a crafted URL or submits malicious input.

The vulnerability affects the EverPress Mailster WordPress plugin in all releases prior to version 4.1.14. Any deployment of Mailster that has not yet been upgraded to 4.1.14 or higher is potentially exposed.

With a CVSS score of 7.1 the vulnerability is considered high severity, although the EPSS score of less than 1% indicates a very low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger it by composing a specially crafted request that includes malicious script content, typically via URL parameters or form fields exposed by the plugin. It appears that no authentication is required, but this is inferred from the information provided. All website visitors could be impacted if they are tricked into opening the crafted payload.