The vulnerability CVE-2025-58821 in wpdever WP Notification Bell (<=1.4.6) is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This allows an attacker with high privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The CVSS v3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject and execute malicious scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium based on the CVSS score of 5.9. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and avoid interacting with untrusted inputs in the affected plugin. Monitor for vendor updates and apply patches promptly once released.