wayneallen-1 vulnerabilities and threats

The Postie plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.87. This flaw allows unauthenticated attackers to inject malicious scripts via the Email Body URL Autolink feature. The vulnerability arises because the ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filtering before saving content, enabling unescaped script injection.