The vulnerability lies in the CM E-Mail Blacklist – Simple email filtering plugin for WordPress. It allows an attacker with administrator‑level privileges to inject arbitrary JavaScript into the ‘black_email’ input field, which is stored by the plugin. Because the input is not properly sanitized or escaped, the stored script will execute in the browser whenever any user visits a page that displays that data. This constitutes a stored cross‑site scripting flaw that could let attackers hijack user sessions, deface content, or spread malware, all contingent on the attacker succeeding in directing victims to the injected page.

The affected product is the CM E-Mail Blacklist – Simple email filtering plugin made by Creative Minds Solutions. Versions up to and including 1.6.2 are vulnerable. The flaw is confined to WordPress installations that are running in multi‑site mode and that have the ‘unfiltered_html’ feature disabled. The plugin is typically used on WordPress sites, and the issue arises whenever an administrator edits the blacklist via the plugin’s settings page.

The CVSS score of 4.4 indicates a moderate severity, and the EPSS score of <1% shows that the likelihood of exploitation is very low at present. The vulnerability does not appear in the CISA KEV catalog, which further suggests it is not currently being actively exploited. However, the flaw requires that an attacker already has administrator access on a multi‑site WordPress installation, and the stored payload will only execute when users open the affected page. Potential attackers would therefore need to compromise a site’s admin account or leverage social engineering to gain such access before exploiting the XSS vector.