The Postalicious WordPress plugin allows administrators or higher roles to store arbitrary JavaScript in its settings. When a site visitor loads a page that displays these settings, the stored script runs in the visitor’s browser. This type of stored XSS can be leveraged to exfiltrate session cookies, deface sites, or deliver malware. The vulnerability is a direct result of missing input validation and output encoding, as identified by CWE‑79.

Vulnerable installations are those running Postalicious version 3.0.1 or earlier on WordPress multi‑site environments where the unfiltered_html capability is disabled. Only administrators or users with equal or greater privileges can trigger the stored payload.

The CVSS base score of 4.4 indicates a moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely but not impossible. The issue is not currently listed in the CISA KEV catalog. Attackers would need authenticated administrative access on a multi‑site installation with unfiltered_html disabled to inject their payload, after which unsuspecting site visitors would be exposed to the injected scripts.