The PostmarkApp Email Integrator plugin for WordPress is vulnerable to stored Cross‑Site Scripting in its pma_api_key and pma_sender_address fields because the input from these fields is not properly sanitized or escaped. An attacker who has Administrator‑level access can inject arbitrary JavaScript into the plugin settings. When any user, even one without administrative rights, visits the settings page, the injected script executes in that user’s browser, potentially allowing the attacker to steal credentials, deface the site, or perform other malicious actions within the user’s session context.

The vulnerability affects installations of the PostmarkApp Email Integrator plugin developed by gagan0123, specifically all versions up to and including 2.4.

The CVSS score of 4.4 indicates a medium impact rating, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have authenticated Administrator‑level access; the attack vector, therefore, is an authenticated privilege escalation within the WordPress installation. Once the attacker injects script into the plugin settings, the script will run automatically for any user who views that page.