Unauthenticated Cross Site Scripting is present in SmartSMTP plugin versions 1.2.0 and earlier. The flaw allows an attacker to inject script code that will run in the browsers of users who view impacted pages, potentially resulting in cookie theft, session hijacking, defacement or the loading of malicious resources. The vulnerability maps to CWE‑79 and requires no authentication to exploit, making it readily usable by any web visitor.

The affected product is the WordPress SmartSMTP plugin developed by ThemeGrill, versions up to and including 1.2.0. No other vendors or product families are indicated.

The CVSS score of 7.1 indicates a high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is any unauthenticated user visiting a public WordPress site with the vulnerable SmartSMTP plugin and supplying malicious input, which will trigger the XSS flaw. Because the flaw is client‑side, exploitation does not require complex prerequisites, raising the likelihood of abuse.