What the vulnerability does
01Description
The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 7.2.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Explanation of Vulnerability in Simple Terms
02Summary
The Notification plugin for WordPress versions 7.2.4 contains a cross-site scripting (XSS) vulnerability in its notification settings. An authenticated administrator with high privileges can inject malicious scripts that execute in the browsers of other users who view affected pages. The vulnerability requires user interaction and affects the integrity and confidentiality of site data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view notification settings.
Potential impact on your site
04Site Impact
Administrators' accounts could be compromised or site data exposed if an admin visits a malicious notification page.
Conditions required to exploit
05Prerequisites
Attacker must be an authenticated administrator; victim must visit an affected page.
Key dates
06Disclosure timeline
November 1, 2021
CVE published
March 31, 2025
Record updated
