This vulnerability allows an unauthenticated attacker to submit crafted form data that is rendered directly into the body of notification emails without escaping. The injected content can contain malicious HTML or JavaScript, enabling the attacker to trick email recipients into executing script in their mail client or to draft phishing attacks that appear legitimate. The weakness is a classic stored cross‑site scripting flaw (CWE‑79) and it grants the ability to alter the contents of email messages sent to any configured recipient.

Statamic Content Management System is affected. Versions prior to 5.74.3 and 6.24.2 contain the unescaped rendering of form input values in the automagic form notification email template. These releases provide default email notification functionality that is vulnerable when an attacker submits data via a publicly exposed form.

The CVSS score of 6.1 indicates moderate severity, and the lack of a KEV listing or EPSS score suggests that exploitation is not currently widespread. The attack vector is a publicly reachable web form that forwards data to the CMS, meaning any organization using an unpatched Statamic installation could be affected. The impact would be limited to the recipients of the notification emails, but could be leveraged for phishing or credential theft. Consequently, the risk is considered moderate to high in environments where email notifications reach broad or highly trusted audiences.