The vulnerability resides in the ufukart Comment Approved Notifier Extended WordPress plugin and allows stored XSS. When an attacker crafts malicious input that is subsequently displayed in the plugin’s comment approval notifications, the script runs in the context of any user who views the populated page, exposing the attacker to the victim’s session cookies and the ability to perform malicious actions on the site.

Versions of Comment Approved Notifier Extended up to and including 5.2 are affected. The plugin is distributed by the vendor "ufukart" and any WordPress installation utilizing these or earlier versions of the plugin is at risk.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a web‑based interaction with the WordPress site, where the attacker submits malicious comment data that the plugin stores and later outputs without proper encoding or escaping, following CWE‑79. The exploit would require an authenticated or unauthenticated user to trigger the comment approval notification flow.