The recently patched REST API Endpoint vulnerability in WordPress could be leveraged to pull off stored cross-site scripting attacks.

The WordPress WP HTML Mail plugin for personalized emails is vulnerable to code injection and phishing due to XSS.