Plunk’s campaign management feature stores the email body content created by authenticated project members and later renders that content in the admin dashboard using React’s dangerouslySetInnerHTML without any HTML sanitization. This stored cross‑site scripting vulnerability allows a lower‑privileged member to embed malicious scripts in a campaign’s email body. When any admin or other member views the campaign, the script runs in their browser session, potentially hijacking the victim’s session or performing unauthorized actions on their behalf.

The vulnerability affects all versions of the open‑source Plunk email platform built on AWS SES before version 0.9.0. Users of the 0.9.0 release and later are not impacted.

The CVSS score of 5.4 indicates moderate risk. No EPSS score is available, and the issue is not listed in CISA KEV, suggesting that widespread exploitation is not currently documented. The likely attack vector is a web‑based interaction within the Plunk administration interface, performed by a lower privileged authenticated user who has permission to create or edit campaigns. The vulnerability can be exploited without needing elevated privileges beyond those required to create a campaign, but the attacker must later be able to view the campaign in the admin dashboard to trigger the malicious script.