The vulnerability permits unauthenticated attackers to inject arbitrary script through the WP Mailster plugin, potentially hijacking user sessions, defacing content, or spreading malware. This is a classic XSS flaw that undermines the confidentiality and integrity of site traffic and is classified as CWE‑79.

The affected product is the WordPress WP Mailster plugin, versions 1.9.0.0 and earlier. Users running these versions on any WordPress installation are susceptible. The plugin is distributed under the brandtoss:WP Mailster product line.

The CVSS score of 7.1 indicates high severity. The EPSS score of < 1% indicates a very low exploitation probability. This vulnerability is not listed in CISA KEV, suggesting no widespread exploitation evidence yet. The likely attack vector is unauthenticated access to the plugin's public interface, allowing an attacker to craft a malicious payload that executes in the browsers of site visitors.