Post Status Notifier Lite
Monthly
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.