The Jabbernotification WordPress plugin processes the PATH_INFO parameter of admin.php without sufficient sanitization or escaping, which allows an attacker to inject arbitrary JavaScript that is reflected back to the victim’s browser. When a user follows a crafted link, the injected script runs in the context of the site, potentially enabling client‑side code execution. No other functionality is disclosed as a consequence of this flaw.

The vulnerability affects the missi Jabbernotification WordPress plugin in all releases up to and including version 0.99‑RC2. Any WordPress site that installs or continues to use one of these versions of the plugin is impacted. No other vendors or products are mentioned.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of < 1% suggests that exploitation has a low probability at present and the vulnerability is not yet listed in CISA KEV. An unauthenticated attacker can create a malicious link that, when opened by a site visitor, triggers the reflected XSS payload. The threat is limited to users who access the compromised site and click the injected link.