The WP Notes Widget plugin by Steve Puddick suffers from a DOM-based cross-site scripting vulnerability due to improper input neutralization during web page generation. This affects all versions up to 1.0.6. The vulnerability allows an attacker with low privileges and requiring user interaction to potentially execute arbitrary code, impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability.

Successful exploitation could lead to execution of malicious scripts in the context of the victim's browser, potentially resulting in limited data disclosure, modification, or disruption of service. The attack requires user interaction and low privileges, limiting the scope of impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Notes Widget plugin if feasible, or apply any available temporary mitigations recommended by the vendor. Monitor official channels for updates.