The BuddyDev BuddyPress Notification Widget versions up to 1.3.3 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with low privileges and network access to inject malicious scripts that execute in the context of other users, potentially leading to confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates that exploitation requires user interaction but has low attack complexity and privileges. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in information disclosure, modification of data, or disruption of service. The CVSS score reflects a medium impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying temporary mitigations such as input sanitization or disabling the affected widget if feasible.