This vulnerability in Peter Westwood's Post By Email plugin (versions up to 1.0.4b) is due to improper input sanitization during web page generation, leading to reflected cross-site scripting (XSS). An attacker could craft a malicious URL or input that, when processed by the vulnerable plugin, executes arbitrary scripts in the victim's browser. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it can impact confidentiality, integrity, and availability of the affected system.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of user credentials, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the Post By Email plugin to mitigate risk. Avoid clicking on suspicious links that could exploit this reflected XSS vulnerability.