The My Email Shortcode plugin contains a stored cross‑site scripting vulnerability that is triggered through the "subject" attribute of the "my‑email" shortcode. Because input is not properly sanitized or escaped, an attacker who can create or edit a post can embed arbitrary JavaScript into the subject field. When a user views that page, the injected script runs within the browser, potentially capturing credentials, defacing the site, or redirecting traffic. This flaw represents a classic input validation weakness identified as CWE‑79.

Any WordPress installation running the My Email Shortcode plugin version 0.91 or earlier, provided the site activates Contributor‑level or higher access for users that may inject content. The plugin is distributed by the vendor paulpela.

The CVSS score of 6.4 marks it as moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated Contributor‑level or above permissions to insert the malicious payload, so the threat surface is limited to sites where such users exist. Once an attacker injects a payload, all users who view the affected page will be exposed to script execution, creating an opportunity for phishing, data theft, or defacement. Given the moderate CVSS score and the requirement for elevated local privileges, the overall risk is moderate but should be mitigated promptly.