The Notibar – Notification Bar for WordPress plugin is vulnerable to Stored Cross‑Site Scripting due to inadequate sanitization of administrator‑supplied input in the settings page. An attacker with administrator or higher permissions can enter arbitrary JavaScript that the plugin stores and later outputs unescaped, causing the script to run whenever a page containing that notification bar is viewed. This flaw is a classic XSS vulnerability (CWE‑79) that can lead to defacement, credential theft, or session hijacking, compromising the integrity and confidentiality of site users.

The affected product is the Notibar – Notification Bar for WordPress developed by ninjateam. Versions 2.1.5 and earlier are impacted. The vulnerability manifests only on WordPress multi‑site installations or on sites where the unfiltered_html capability has been disabled. All administrators who can edit the plugin settings are at risk.

The CVSS score of 5.5 indicates moderate impact, while the EPSS score of less than 1% reflects a low exploitation probability under current conditions. The flaw requires authenticated administrator‑level access, so it is not publicly exploitable without first gaining such permissions, but once these credentials exist the attacker can immediately inject and execute scripts, and the vulnerability is not listed in the CISA KEV catalog. Prompt remediation is advised to prevent potential XSS attacks.