The vulnerability arises because the Custom New User Notification plugin registers multiple email‑related settings without applying sanitization or escaping when storing and rendering them. An attacker who can authenticate as an administrator can inject malicious JavaScript into fields such as "User Mail Subject" or "Admin From Email". When any administrator later visits the plugin’s settings page, the stored script will execute in that staff member’s browser, enabling the attacker to perform actions such as phishing, cookie theft, or form manipulation on behalf of the victim. This is a classic stored XSS flaw that is not mitigated by WordPress core but entirely depends on the plugin’s implementation.

The affected product is the WordPress plugin "Custom New User Notification" developed by rafasashi. All releases up to, and including, version 1.2.0 are vulnerable. Site administrators using these versions should treat the plugin as compromised until upgraded or removed.

The CVSS v3 score for this weakness is 4.4, indicating moderate severity. No EPSS data is available, and the flaw is not currently listed in the CISA KEV catalog, implying limited public exploitation yet. The attack vector requires authenticated access with Administrator privileges; therefore, the likelihood of exploitation is tied to the attacker’s ability to gain such credentials. Once authenticated, the flaw can be triggered simply by an administrator re‑visiting the settings page, allowing widespread impact on the site’s admin interface.