The Mail Mint plugin for WordPress contains a CSRF vulnerability that arises from missing nonce validation on the create_or_update_note function. An unauthenticated attacker can forge a request to this endpoint, which will create or modify a contact note when an administrator is tricked into clicking a link. Because the plugin does not sanitise or escape the note content, malicious data can be stored and later executed in the browser when the note is displayed, resulting in stored Cross‑Site Scripting. The flaw permits an attacker to inject scripts that run in the context of any user who views the note, potentially leaking credentials or hijacking sessions. The impact is limited to the data displayed by the plugin, but the attack vector and lack of validation make it a moderate risk if an administrator is susceptible to the social engineering component.

All versions of the Mail Mint WordPress plugin up to and including 1.19.2, provided by getwpfunnels:Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails.

The CVSS score of 5.4 indicates a medium severity, and the EPSS score of less than 1% suggests a very low likelihood that the vulnerability will be actively exploited at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires an administrator to click a malicious link; there is no direct network takeover. Given the reliance on social engineering, the actual risk depends on the security posture of the site’s admin users. However, the combination of CSRF and stored XSS warrants remediation to prevent potential data compromise or credential theft.