WP Mailster CVE-2026-111830

Exploitation targets the WP Mailster WordPress plugin at versions up to and including 1.9.1.0. The CVSS vector requires victim user interaction (UI:R) - a user must load the page rendering the stored payload for the script to execute - and the scope change (S:C) indicates execution in a security context different from the injection point, typically an administrator or other privileged user viewing the stored content. The specific feature, field, or endpoint used to inject the stored payload is not described in the available sources, and although the vector states PR:N (no privileges), stored XSS in this plugin may in practice require an authenticated role to store content; this should be verified with the vendor. Limiting factors: requires the stored content to be viewed by a victim (no execution without a page load) and impact is bounded to low confidentiality/integrity/availability.

This is a mid-severity Stored Cross-Site Scripting flaw (CWE-79) in the WP Mailster WordPress plugin, reported by Patchstack and rated CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C. The elevated score over a typical reflected XSS comes from the scope change (S:C) plus low impact to confidentiality, integrity and availability - consistent with a stored payload that executes in a different security context, most plausibly an administrator or other user rendering the stored content (hence UI:R). Key exploitation signals are weak to absent: there is no CISA KEV listing, so this is not confirmed actively exploited; no EPSS score was supplied, so statistical exploitation probability cannot be weighed; and no proof-of-concept or exploit code is referenced beyond the Patchstack advisory itself. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a patch-on-normal-cadence posture rather than an incident. One caveat worth verifying: the vector asserts PR:N (unauthenticated) for a stored XSS, yet the Patchstack description does not state how the payload is injected - many stored-XSS issues in WordPress plugins require an authenticated low-privilege role to store content, so the true privilege prerequisite should be confirmed against the vendor advisory. Overall this is a real but moderate-priority issue: genuine stored XSS with session/context impact, but no evidence of in-the-wild exploitation and limited raw impact.

An attacker places a malicious script into an input field that WP Mailster stores and later renders without proper neutralization; when a victim (likely a site administrator or subscriber) views the page containing the stored payload, the script executes in their browser session. No public exploit code is identified, and the injection mechanism is not described in the available sources; the CVSS vector indicates network reach with low complexity but requires the victim to load the affected page (UI:R).