WP Mailster EUVD-2026-93086

Exploitation requires the attacker to get a WordPress user to interact with attacker-controlled content (UI:R) - for example clicking a crafted link or loading a page that renders the injected payload - on a site running WP Mailster version 1.9.0.0 or earlier. No authentication is required (PR:N), so any unauthenticated remote attacker can attempt it, but success is LIMITED by the mandatory user-interaction step and by the site actually having the vulnerable plugin installed and the affected feature exposed. The description does not name a specific parameter, feature toggle, or non-default configuration, so the precise injection point is not specified in the available data.

This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low attack complexity, and no required privileges (PR:N, unauthenticated) raise its theoretical reach, but the requirement for user interaction (UI:R) means an attacker must lure or wait for a victim to trigger the payload, which meaningfully lowers real-world exploitability versus a no-interaction bug. The scope change (S:C) reflects that injected script executes in the victim's browser context, impacting resources beyond the vulnerable component. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only intelligence source is Patchstack (also mirrored to CVE.org and ENISA EUVD), with no independent vendor advisory confirming patch status. Net assessment: a legitimate but not urgent issue - a classic high-CVSS XSS whose real risk is tempered by required user interaction, absence of exploitation signals, and the limited footprint of the affected plugin; prioritize routine patching rather than emergency response.

An unauthenticated attacker crafts a malicious URL or input containing JavaScript targeting a vulnerable parameter in WP Mailster <= 1.9.0.0 and delivers it to a WordPress user (e.g., via phishing or a planted link). When the victim's browser renders the unsanitized output, the script executes in their session context, enabling session/cookie theft or actions on their behalf. No public exploit code is referenced, and successful exploitation depends on the victim interacting with the attacker-supplied content (UI:R).