Postie, a WordPress email plugin, is vulnerable to a stored cross‑site scripting flaw in all releases through 1.9.87. The flaw originates from the automatic conversion of URLs in email bodies into hyperlinks without sufficient sanitization or escaping. When an email is processed, the plugin removes WordPress’s built‑in KSES output filters and writes the raw, potentially malicious HTML into post content. As a result, an unauthenticated user can embed any JavaScript code in the body of an email, which will be stored and rendered in subsequent visitor pages.

The affected product is the WordPress Postie plugin, vendor Wayne Allen (product code wayneallen-1). All versions up to and including 1.9.87 are vulnerable. WordPress site administrators who rely on these plugin versions should verify the current deployment and plan an upgrade or patch.

The CVSS score for this issue is 5.4, indicating a moderate risk. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only unauthenticated access to the /?postie=get-mail endpoint, which performs no capability check. Once a malicious email is submitted, the stored XSS payload will execute in the browsers of any user who views the resulting post, potentially allowing credential theft, session hijacking, or defacement.