The PostmarkApp Email Integrator plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the pma_api_key and pma_sender_address parameters in the plugin settings lack sufficient sanitization and escaping, allowing authenticated administrators to inject arbitrary scripts. These scripts execute in the context of users visiting the settings page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions up to and including 2.4. No known exploits are reported in the wild, and no patch information is provided.

An attacker with Administrator-level access can inject malicious scripts into the plugin settings, which execute when users access the settings page. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of the settings page content. There is no reported impact on availability. The vulnerability requires high privileges and no user interaction beyond visiting the settings page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and consider limiting access to the plugin settings page. Monitor official channels for updates or patches from the vendor.