The Easy Voice Mail plugin accepts a user‑controlled message parameter without proper sanitization or escaping. An attacker who has administrator or higher privileges can inject arbitrary JavaScript that is stored and then displayed to any visitor of the page containing the message. This stored XSS allows the attacker to run scripts in the context of site visitors, potentially stealing cookies, defacing content, phishing users, or hijacking sessions. The vulnerability is a classic input validation flaw (CWE‑79).

The flaw exists in the Easy Voice Mail WordPress plugin from phoenixstudiodz and affects every release up to and including 1.2.5. All versions earlier than 1.2.6 are vulnerable; the issue remains when the plugin remains installed at these versions.

With a CVSS score of 6.1 the vulnerability is considered medium severity, and an EPSS score of less than 1 % indicates a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Because the vulnerability requires an authenticated administrator to inject the malicious payload, attackers must first compromise site credentials or elevate privileges. Once injected, the script will run for any user who loads the affected page, creating an opportunity for widespread client‑side attacks. The overall risk is moderate, primarily driven by the potential for phishing and credential theft rather than direct data loss or server compromise.