The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting (XSS) in the WPDeveloper NotificationX plugin. Because the payload is persisted through the plugin’s storage mechanisms, it will be delivered to every browser that renders the affected content. The impact is limited to the web application and the browsers of site visitors; no compromise of the underlying WordPress installation or server is described in the official disclosure.

This issue affects the WPDeveloper NotificationX plugin for WordPress in any installation running version 2.9.5 or earlier. The vulnerability is listed for all releases up to and including 2.9.5; later versions are not affected.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low but non‑zero probability that this vulnerability is exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker with the ability to enter data into the plugin’s content creation or editing interface; after the input is stored, any user who views the affected page will receive the malicious script. This inference is drawn from the wording that the flaw permits stored XSS, but the exact prerequisites are not explicitly stated in the supplied information.