This vulnerability is caused by improper neutralization of script‑related HTML tags in the Better Notifications for WP plugin. When a notification containing malicious JavaScript is rendered, the browser executes that code in the context of the site, allowing an attacker to inject arbitrary scripts or redirect users, potentially leading to session hijacking, credential theft, or site defacement.

The flaw affects all installations of Made with Fuel Ltd.'s Better Notifications for WP plugin up through version 1.10.1. Site administrators should upgrade to at least 1.10.2. The plugin is commonly embedded in WordPress sites by developers and administrators, so any WordPress installation using the vulnerable plugin version is in scope.

The CVSS score of 5.3 reflects moderate severity, but the lack of an EPSS score and absence from the CISA KEV catalog suggest no widespread exploitation yet. Nonetheless, basic cross‑site scripting can be exploited remotely via crafted notification input, giving remote code execution within the browser context until the plugin is updated.