The vulnerability enables an unauthenticated attacker to inject arbitrary JavaScript into the WordPress Email Essentials plugin output. This client‑side execution can lead to defacement of the site, theft of session cookies, phishing, or other malicious behaviors executed in the browsers of any visitor or administrator. The weakness is a classic reflected or stored XSS flaw (CWE‑79).

The issue affects WordPress sites running the Acato Email Essentials plugin version 6.0.6 or earlier. Versions 6.0.0 through 6.0.6 are vulnerable; any installation that has not been updated to 6.0.7 or newer is at risk.

With a CVSS score of 7.1 the vulnerability is considered high. Although the EPSS score is not provided, the lack of activity in the KEV catalog does not diminish the risk of exploitation. The flaw is unauthenticated and can be triggered by any user with access to the plugin’s web interface, making it a remote attack vector via a web browser. An attacker can easily craft a malicious link or form that, when visited or submitted by a site user, injects the payload into the page.