The NotificationX plugin for WordPress, which provides live sales notifications and other social proof features, is vulnerable to stored cross-site scripting due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via the plugin's content settings, which are then stored and executed in the context of users viewing the affected pages. This vulnerability affects all versions up to and including 2.9.3, particularly in multi-site environments or where unfiltered_html is disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change with limited confidentiality and integrity impact but no availability impact.

An attacker with administrator-level access can inject malicious scripts into NotificationX notification content, leading to stored XSS attacks. This can result in the execution of arbitrary JavaScript in the context of users visiting the affected pages, potentially compromising user sessions or performing unauthorized actions. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability only affects multi-site WordPress installations or those with unfiltered_html disabled, limiting the scope of affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the NotificationX plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.