The MailArchiver WordPress plugin stores configuration values that are presented without proper sanitization or escaping. An attacker with administrator‑level privileges can place arbitrary HTML and JavaScript code into these settings. When other users load a page that renders the stored values, the injected script executes in their browsers, enabling the attacker to run custom code in the victim’s context. This flaw directly permits execution of arbitrary scripts on any site page that includes the vulnerable setting entries.

All installations of MailArchiver version 4.4.0 or earlier on WordPress, including multisite networks and configurations in which the unfiltered_html capability is disabled for non‑administrators. The vulnerability is localized to the plugin’s Settings page where unescaped input is stored.

The advisory assigns a CVSS score of 4.8 and an EPSS score of less than 1 %, indicating a low but non‑zero likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires that the attacker possess administrator privileges to inject the malicious content. Once the payload is stored, it will automatically execute for any user who views the affected page, making the attack impact purely to those who are able to reach the rendered settings.