{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1672", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-24T23:26:36.702Z", "datePublished": "2025-03-06T09:21:19.616Z", "dateUpdated": "2026-04-08T17:10:55.297Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:55.297Z"}, "affected": [{"vendor": "ninjateam", "product": "Notibar \u2013 Notification Bar for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Notibar \u2013 Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9985627d-9ba4-4a5b-94fb-06bcc769acfd?source=cve"}, {"url": "https://wordpress.org/plugins/notibar/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3246799/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Khang Duong"}], "timeline": [{"time": "2025-03-05T21:11:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-06T16:24:36.313948Z", "id": "CVE-2025-1672", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-06T16:24:45.481Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-06T16:24:36.313948Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-06T16:24:20.823Z"}}], "cna": {"title": "Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Khang Duong"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ninjateam", "product": "Notibar \u2013 Notification Bar for WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-05T21:11:50.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9985627d-9ba4-4a5b-94fb-06bcc769acfd?source=cve"}, {"url": "https://wordpress.org/plugins/notibar/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3246799/"}], "descriptions": [{"lang": "en", "value": "The Notibar \u2013 Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-06T09:21:19.616Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1672", "state": "PUBLISHED", "dateUpdated": "2025-03-06T16:24:45.481Z", "dateReserved": "2025-02-24T23:26:36.702Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-06T09:21:19.616Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Notibar \u2013 Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El complemento Notibar \u2013 Notification Bar for WordPress para WordPress es vulnerable a Cross-Site Scripting almacenados a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 2.1.5 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio e instalaciones en las que se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-1672", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-06T10:15:11.897", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3246799/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/notibar/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9985627d-9ba4-4a5b-94fb-06bcc769acfd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:04:58.089351+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Notibar plugin version that has fixed the XSS issue (any version newer than 2.1.5).", "If an upgrade is not feasible, remove or reset any custom notification messages that were created by administrators to eliminate stored malicious scripts.", "Disable the unfiltered_html capability for all but trusted administrators, or implement a site\u2011wide Content Security Policy that restricts script execution from unknown origins."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is the Notibar \u2013 Notification Bar for WordPress developed by ninjateam. Versions 2.1.5 and earlier are impacted. The vulnerability manifests only on WordPress multi\u2011site installations or on sites where the unfiltered_html capability has been disabled. All administrators who can edit the plugin settings are at risk.", "description_and_impact": "The Notibar \u2013 Notification Bar for WordPress plugin is vulnerable to Stored Cross\u2011Site Scripting due to inadequate sanitization of administrator\u2011supplied input in the settings page. An attacker with administrator or higher permissions can enter arbitrary JavaScript that the plugin stores and later outputs unescaped, causing the script to run whenever a page containing that notification bar is viewed. This flaw is a classic XSS vulnerability (CWE\u201179) that can lead to defacement, credential theft, or session hijacking, compromising the integrity and confidentiality of site users.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate impact, while the EPSS score of less than 1% reflects a low exploitation probability under current conditions. The flaw requires authenticated administrator\u2011level access, so it is not publicly exploitable without first gaining such permissions, but once these credentials exist the attacker can immediately inject and execute scripts, and the vulnerability is not listed in the CISA KEV catalog. Prompt remediation is advised to prevent potential XSS attacks."}}}}, "created": "2026-04-21T22:15:45.897463+00:00", "updated": "2026-04-21T22:15:45.897474+00:00", "vendors": []}