The CodeSolz Ultimate Push Notifications plugin contains a reflected XSS flaw where unsanitized input can be injected into page content. This weakness, classified as CWE‑79, permits an attacker to craft a URL or input that is reflected back to the victim without proper escaping. Successful exploitation could lead to the execution of arbitrary script code within the victim's browser, potentially compromising session data, defacing the site, or installing malware on the client machine.

WordPress sites that install the Ultimate Push Notifications plugin version 1.2.0 or earlier. The vulnerability was introduced in the earliest released version and remains present up through 1.2.0 inclusive.

The vulnerability has a CVSS score of 7.1, indicating a high severity for the affected plugin. The EPSS score is less than 1%, suggesting that although the flaw is high impact, it is currently considered unlikely to be widely targeted. The issue is not listed in CISA’s KEV catalog. Attackers would need only a crafted URL or input that is reflected in the page; no privileged access is required, making exploitation relatively straightforward from any user with access to the plugin’s pages.