The freemp JavaScript Notifier plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the plugin fails to adequately sanitize and escape user-supplied attributes processed in the wp_footer action, allowing authenticated administrators to inject malicious JavaScript code. This code executes in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 1.2.8. The CVSS 3.1 base score is 4.4, reflecting a network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can inject persistent malicious scripts into pages rendered by the plugin. This can lead to unauthorized script execution in the browsers of users who visit the affected pages, potentially compromising user data or session integrity. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the freemp JavaScript Notifier plugin if feasible to reduce risk.