This vulnerability arises from inadequate sanitization of user input when generating web pages, enabling reflected XSS. A malicious actor could supply crafted data that is echoed back in the browser, potentially allowing execution of arbitrary scripts in the context of the logged‑in user. Based on the description, it is inferred that the primary impact could include compromise of confidentiality and integrity for users who view affected pages, and the potential for session hijacking or credential theft.

The flaw affects the WordPress AcyMailing SMTP Newsletter plugin supplied by Datasolution, versions up to and including 11.1.0. Any WordPress installation that has this plugin installed and configured for newsletter delivery is susceptible if the plugin receives unsanitized input values.

The CVSS score of 7.1 indicates a high severity. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog does not diminish the potential for exploitation. The likely attack vector is a reflected request through a user‑submitted parameter that the plugin echoes into the page—typically via a data entry form or newsletter subscriber URL. An attacker could embed malicious JavaScript in such a parameter to infect the browsers of site visitors or administrators.