Unauthenticated reflected XSS in the WordPress weMail plugin version 2.1.2 and earlier allows an attacker to inject malicious scripts into a page viewed by unsuspecting users. The flaw is a classic input‑sensitivity problem (CWE‑79) that can be leveraged to steal session cookies, deface content, or launch phishing attacks. Because the vulnerability is in the plugin’s front‑end rendering of user‑supplied data, it can be triggered by any user accessing the affected page.

The affected product is the weMail plugin for WordPress, developed by weDevs. Versions up to and including 2.1.2 are vulnerable; the latest release 2.1.3 contains the fix.

The CVSS score of 7.1 marks it as high severity. No EPSS score is available, but the issue is unauthenticated and likely to be exploitable by anyone who can construct a malicious request. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been widely abused in the wild. An attacker can send a crafted URL to an end‑user that triggers the reflected payload, causing the browser to execute arbitrary JavaScript.