This vulnerability in WP Mailster (versions <= 1.8.16.0) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with at least low privileges and requiring user interaction could exploit this to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and a scope change.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. The medium severity reflects that exploitation requires some privileges and user interaction, and the impact is not critical but could affect user data and application behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should limit privileges to trusted users and monitor for suspicious activity related to WP Mailster. Avoid exposing the plugin to untrusted users where possible.