The WP Mailster plugin for WordPress, developed by brandtoss, contains a reflected cross-site scripting vulnerability identified as CVE-2025-24688. This vulnerability is due to improper input neutralization during web page generation, which can allow an attacker to inject and execute arbitrary scripts in the context of a victim's browser session. The issue affects all versions up to and including 1.8.20.0. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to low levels. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. The CVSS vector indicates that the attack requires user interaction but no privileges or authentication. The scope is changed, meaning the vulnerability affects resources beyond the vulnerable component. Confidentiality, integrity, and availability impacts are all rated low but present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider temporary mitigations such as disabling or restricting the use of the WP Mailster plugin. Monitor vendor channels for updates regarding patches or official mitigations.