CVE-2025-1672

Vulnerability

Details

The Notibar – Notification Bar for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.5 [1]. The vulnerability arises from insufficient input sanitization and output escaping in the plugin's admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts.

Exploitation

To exploit this vulnerability, an attacker must have administrator-level access to a WordPress installation. The attack is only effective on multi-site installations or on single-site installations where the unfiltered_html capability has been disabled. The injected scripts are stored and will execute whenever a user accesses a page containing the malicious payload.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the affected pages.

Mitigation

Users should update the Notibar plugin to a patched version if available. As of the publication date, version 2.1.5 is the latest affected version; users are advised to check the plugin's WordPress.org page [1] for updates. Restricting administrator access and enabling unfiltered_html where possible can reduce the attack surface.