The BuddyPress Notification Widget plugin for WordPress contains a stored XSS flaw caused by improper sanitization of user input in the plugin’s web page output. An attacker can insert malicious script that executes in the browser of any user who views a page rendering the widget, enabling session hijacking, defacement, or arbitrary actions performed in the victim’s context, thereby compromising confidentiality and integrity.

All installations of BuddyPress Notification Widget version 1.3.3 and earlier released by BuddyDev are affected. The flaw is confined to the plugin code and is independent of the WordPress core version.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, because stored XSS can be triggered by any content that can be entered into the widget configuration—often by site administrators—an attacker with dropping privileges can easily exploit this weakness, making it a high‑priority concern for sites exposed to configuration input.