The WP Mail plugin by mndpsingh287 contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted input, potentially leading to information disclosure, session hijacking, or other impacts on user security. The vulnerability affects versions up to 1.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other user-targeted attacks. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider applying temporary mitigations such as input validation or disabling the affected plugin if feasible.