Description

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-10-03T07:16:48.853Z",
  "pubdate": "2026-10-03T07:16:48.853Z",
  "executiveSummary": "The WPFront Notification Bar plugin for WordPress, in versions up to and including 3.5.1, contains a Reflected Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from the insecure handling of the 'write_debug_logs' debug-log output path, which fails to sanitize or escape data reflected from the request environment.\nUnauthenticated attackers can leverage this vulnerability to execute arbitrary JavaScript within the context of a victim's browser session.\nThe attack vector requires social engineering, as an attacker must trick an authenticated user or administrator into interacting with a specially crafted URL containing malicious script payloads.\nSuccessful exploitation allows for the execution of unauthorized scripts, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information.\nGiven that the payload is injected directly into a script block within the site's footer, the impact is significant, potentially compromising the integrity and confidentiality of user interactions with the affected WordPress site.",
  "technicalDetails": "The vulnerability resides in the core logic of the WPFront Notification Bar plugin's debug-log functionality, specifically within the filter() method. The application incorrectly reflects the raw value of the '$_SERVER['REQUEST_URI']' superglobal variable into the frontend output.\nThe root cause is the improper usage of the 'vprintf()' function. The application attempts to log the current URL using a format string: 'Current URL is \"%s\"'. By passing the raw '$_SERVER['REQUEST_URI']' value directly into this function, the plugin fails to perform necessary output sanitization or context-aware escaping.\nThis data is then rendered directly within a <script> block emitted at the 'wp_footer' hook. Because the input is injected into an executable script context without prior filtering, the browser treats the input as code rather than literal text.\nThe attack flow follows these steps: 1) The attacker constructs a malicious URL where the request path contains a JavaScript payload (e.g., 'example.com/<script>alert(1)</script>'). 2) The attacker baits a victim into clicking this URL. 3) When the page loads, the 'filter()' method retrieves the URI, including the malicious payload. 4) The plugin injects this raw URI into the debug output in the footer. 5) The browser interprets the injected code within the script block and executes it.\nThe vulnerability is accessible to unauthenticated attackers via the web interface. Because the reflected data is echoed in a script block, common browsers will execute the injected payload as soon as the footer is rendered. No specific privilege levels are required to trigger the reflection, although the impact is highest when the victim possesses elevated privileges, such as an administrator, as it may lead to full site compromise.\nThe lack of input validation on the server-side and the absence of output escaping on the client-side allows for arbitrary script execution. This bypasses typical browser security headers if they are not correctly configured to restrict inline scripts. Since the reflection occurs within a hardcoded <script> tag, the attacker does not need to break out of HTML attributes, effectively allowing for direct code injection."
}