This vulnerability allows an attacker to inject arbitrary JavaScript that is stored in the email log’s recipient display name field. When an administrator opens the detailed view of a logged email and uses the navigation controls to move between entries, the plugin renders the name without proper escaping, causing the injected script to execute in the administrator’s browser. The injected code runs with the privileges of the logged‑in administrator, potentially enabling session hijacking, credential theft, or other malicious actions within the WordPress site.

The flaw exists in the FluentSMTP WordPress plugin up to and including version 2.2.95. Users running any of the supported mail providers—Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail, or any SMTP—must verify that their installation is not using a vulnerable version.

The CVSS score of 7.2 classifies this as a high severity issue. Although no EPSS data is provided, the lack of a KEV listing suggests that widespread exploitation has not yet been confirmed, but the vulnerability remains objectively dangerous because unauthenticated users can craft the malicious recipient name. The exploit path requires the attacker to send an email via the plugin (for example, by triggering wp_mail()), then later an administrator must visit the logs detail page where the payload is rendered. Once those prerequisites are met, the attacker can execute arbitrary code in the administrative context.