The Post Status Notifier Lite WordPress plugin versions prior to 1.13.0 fail to properly sanitize the 'mod' URL parameter on the admin settings page (admin.php?page=post-status-notifier-lite). This improper escaping allows an attacker to inject and execute arbitrary JavaScript code in the context of an administrator's browser session, constituting a reflected Cross-Site Scripting (CWE-79) vulnerability. Exploitation requires tricking an administrator into clicking a specially crafted URL.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the administrator's browser session. This may lead to session hijacking, unauthorized actions within the WordPress admin interface, or other malicious activities performed with administrator privileges. However, exploitation requires social engineering to lure an administrator to a malicious URL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted or suspicious URLs containing the 'mod' parameter in the Post Status Notifier Lite plugin's admin pages. Monitor vendor channels for updates and apply any released patches promptly.