WPFront Notification Bar EUVD-2026-91956

Exploitation requires the WPFront Notification Bar plugin's debug logging feature (write_debug_logs) to be enabled - this is a non-default operator setting, without which the vulnerable <script> output on wp_footer is never emitted. When that condition is met, an unauthenticated remote attacker can exploit it, but only if a victim clicks a specially crafted link (UI:R) whose URL carries the payload reflected from $_SERVER['REQUEST_URI']. Limiting factors: non-default debug-logging configuration, required victim interaction, and the client-side-only, limited impact (no server-side code execution).

This is a reflected XSS (CWE-79) carrying a CVSS 3.1 base of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - network-reachable and unauthenticated (PR:N), but gated by user interaction (UI:R) and limited impact (C:L/I:L/A:N) with a scope change. No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules there is no public exploit identified at time of analysis - this is NOT confirmed active exploitation. Crucially, the published CVSS vector appears to omit a decisive limiting factor stated plainly in the description: the vulnerable code path only emits when the plugin's debug logging (write_debug_logs) is enabled, which is a non-default operator setting outside the attacker's control. That makes AC:L optimistic - real-world exploitability is narrower than the 6.1 suggests, so this is a genuine-but-low-priority issue for most deployments rather than a widespread threat. Treat it as a medium-severity, conditionally-exploitable client-side flaw: patch in routine cycles, prioritize sites known to run with debug logging enabled.

An attacker crafts a link to a vulnerable WPFront Notification Bar site (running with debug logging enabled) whose URL path or query string contains a JavaScript payload, then lures a visitor into clicking it. The plugin reflects the raw $_SERVER['REQUEST_URI'] through vprintf() into a <script> block emitted on wp_footer, so the payload executes in the victim's browser in the site's origin. No public exploit code was identified at time of analysis; exploitation requires the victim to click the crafted link (UI:R).