The Fluid Notification Bar plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts through the plugin's admin settings, which are then stored and executed when users access the affected pages. This vulnerability specifically impacts multi-site WordPress setups or those with unfiltered_html disabled, and affects all plugin versions up to and including 3.2.3. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with a scope change.

An attacker with administrator-level privileges can inject and store malicious scripts that execute in the context of users visiting the affected pages, potentially leading to data disclosure or manipulation of site content. The vulnerability does not impact availability. Because exploitation requires high privileges and affects multi-site or restricted HTML capability environments, the overall impact is limited but still significant within those contexts.

No official patch or fix is currently documented. Users should verify the vendor advisory for updates. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Fluid Notification Bar plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for official patches or updates addressing this vulnerability.