The JavaScript Notifier WordPress plugin is vulnerable because user‑supplied attributes in plugin settings are not properly sanitized. An administrator can inject arbitrary JavaScript that is rendered in the page footer, causing the code to run for any visitor to the site. This stored cross‑site scripting attack leverages insufficient input sanitization and output escaping on user‑supplied attributes in the wp_footer action. The weakness corresponds to CWE‑79.

All installations of the JavaScript Notifier plugin with version 1.2.8 or earlier are affected. The vulnerability is exploitable by anyone with administrator‑level privileges to the WordPress site and applies to all pages that load the plugin’s footer code.

The CVSS score of 4.4 indicates low severity, but the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentic access with administrative rights and relies on the attacker inserting malicious content into plugin settings, which will then be served to all site visitors. The overall risk is low, primarily driven by the credential requirement and low exploit likelihood.