Improper neutralization of input during web page generation allows an attacker to inject malicious scripts that are stored and served to all users. This stored XSS flaw can lead to phishing, cookie theft, or malicious code execution on the browsing context of visitors. The vulnerability is classified as CWE‑79, representing a failure to properly escape special characters before rendering user input.

Arefly WP Header Notification plugin is affected from the earliest release through version 1.2.7. All installations using any of those versions are vulnerable regardless of the WordPress core version.

Based on the description, the likely attack vector is an attacker injecting malicious payloads via the notification configuration interface. The CVSS score of 5.9 indicates a moderate impact, while the EPSS score of less than 1 % suggests the probability of exploitation is currently low. The plugin does not receive a KEV listing, so it is not known to be actively exploited in the wild. Exploitation requires the attacker to supply a malicious payload in a stored field that the plugin renders unescaped, typically through the notification configuration interface. Once injected, the script runs in the browser context of any visitor viewing pages where the notification is displayed.