The Push Notification for Post and BuddyPress plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in the 'pushnotificationid' parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a malicious link. The issue affects all versions up to and including 2.07. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. No patch or official fix information is provided in the available data.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially resulting in information disclosure or manipulation of user interactions. The impact is limited to confidentiality and integrity with no availability impact. Since the vulnerability requires user interaction and is reflected, the attack surface is somewhat constrained. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to affected functionality. Additionally, educating users to avoid clicking suspicious links related to this plugin can reduce risk. Monitor the vendor's channels for updates regarding patches or official mitigations.