This vulnerability is an improper neutralization of script‑related HTML tags in the NotificationX plugin, allowing attackers to inject malicious JavaScript into web pages viewed by site users. The weakness aligns with CWE‑80 and can lead to cross‑site scripting that may result in defacement, session hijacking, or data exfiltration when visitors load affected pages.

The affected product is WPDeveloper’s NotificationX plugin for WordPress. All installations using versions 3.3.6 and earlier are vulnerable; newer releases are not affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Attackers can exploit the vulnerability by supplying crafted input through the plugin’s configuration or content creation interface, resulting in script execution in the context of the site’s visitors. Proper input validation and sanitization are required to mitigate this risk.