The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious scripts into the WordPress site. The vulnerability is identified as CWE‑79. The stored XSS occurs when input is not neutralized during rendering in the plugin, enabling potentially arbitrary JavaScript execution in the context of the affected site's visitors. Attackers could use the injected scripts to steal user data, hijack sessions, or deface the website, compromising confidentiality, integrity, and availability of the affected WordPress instance.

The affected product is the Proof Factor – Social Proof Notifications plugin from Proof Factor LLC. Versions n/a through 1.0.5 are vulnerable. Any WordPress site that has installed this plugin, regardless of WordPress core version, is at risk until a later version or removal is applied.

The CVSS score is 5.9, indicating moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog, indicating no known exploitation so far. The likely attack vector is that a user with the authority to create or edit notifications can supply malicious content that is stored and later rendered to site visitors, enabling XSS. If an attacker can use a publicly accessible form, the risk could broaden. Overall, the risk is moderate but exploitable without a critical patch.