The Target Notifications plugin for WordPress contains a Reflected Cross‑Site Scripting (XSS) flaw that occurs when the plugin does not properly neutralize user input before outputting it to a web page. Because the plugin echoes back data submitted by a user without filtering, an attacker could inject malicious JavaScript that would execute in the victim’s browser when the affected page is viewed. This vulnerability is classified under CWE‑79.

WordPress sites that have installed the Target Notifications plugin version 1.1.1 or earlier are vulnerable. The plugin, distributed by wpdever and named Target Notifications, is affected on any WordPress environment where the plugin is active, regardless of underlying OS or WordPress version.

The CVSS score of 7.1 indicates high severity. EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack scenario involves crafting a URL or submitting form data that the plugin reflects unfiltered, and it probably does not require authentication (this inference is based on the fact that the input is reflected directly). The impact is limited to script execution in the victim’s browser context.