The WP Mail plugin for WordPress fails to neutralize user‑supplied input when generating a page, creating a reflected cross‑site scripting flaw (CWE‑79). Malicious script can be injected through crafted URLs or form fields and will run in the browser of any user who views the affected page. This can enable session hijacking, credential theft, defacement, or redirection to phishing sites.

WordPress sites that deploy the WP Mail plugin from the author mndpsingh287 are vulnerable. All releases up to and including version 1.3 are affected; no lower bound is specified, so any installation using a version 1.3 or earlier is at risk.

The publicly available CVSS score of 7.1 denotes a high severity of impact. The EPSS score of less than 1% indicates that, as of the latest data, the probability of real‑world exploitation is low. The vulnerability is not catalogued in CISA’s KEV. Attackers would need to lure a victim to a specially crafted URL or submit malicious input, requiring user interaction. Despite the low current exploitation likelihood, the potential for client‑side compromise remains significant.