The wpdever WP Notification Bell plugin (versions <= 1.4.6) contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with high privileges to inject malicious scripts that are stored and later executed in the context of users who view the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, exploitation requires high privileges and user interaction, limiting the ease of attack. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and avoid interacting with untrusted input in the plugin. Monitor vendor channels for updates and apply patches promptly once released.