WPFront Notification Bar <= 3.5.1 - Unauthenticated Reflected Cross-Site Scripting via Request URL in Debug Log Output

ID

WPSEC-2026-0275

Plugin

WPFront Notification Bar (wpfront-notification-bar)

Affected

from 3.5.0 before 3.5.2

Remediation

Update to 3.5.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

WPFront Notification Bar on WPSec AttackSurface

Fix released

2026-09-29

Published

2026-10-02

Description

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the request URL in versions 3.5.0 through 3.5.1. When the 'Display based on text in URL' page filter is used and the visited URL does not contain the configured text, the plugin logs the raw request URI and, with debug mode enabled, writes it without escaping into an inline JavaScript console.log() string in the page footer. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the notification bar to be enabled with both debug mode and the URL-text display filter configured, which are not default settings.

References

• https://wpsec.com/vuln/WPSEC-2026-0275/
• https://plugins.svn.wordpress.org/wpfront-notification-bar/tags/3.5.2/
• https://wordpress.org/plugins/wpfront-notification-bar/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS