This vulnerability in the Email Notification on Login plugin (versions <= 1.7.0) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges can inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with limited impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in limited confidentiality, integrity, and availability impacts. The attacker must have high privileges and require user interaction to trigger the vulnerability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and be cautious with user input handling in the affected plugin. Monitor for vendor updates to apply any forthcoming patches promptly.