WordPress WPFront Notification Bar plugin <= 3.5.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin WPFront Notification Bar versions = 3.5.1...

CVE-2026-93896

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

CVE-2026-93896 WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

CVE-2026-93896

The WPFront Notification Bar plugin for WordPress (versions up to and including 3.5.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the write_debug_logs output path, which reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly into a [removed] b...

EUVD-2026-91956

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

CVE-2026-93896 WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

CVE-2026-93896: Improper Neutralization of Input During Web Page Generation

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a...

PT-2026-104547

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar versions prior to 3.5.2 Description Reflected Cross-Site Scripting occurs when the write debug logs debug-log output path reflects the raw value of the $ SERVER'REQUEST URI' variable through the vprintf function within...

EUVD-2024-16418

Malicious code in bioql PyPI...

EUVD-2024-26813

Malicious code in bioql PyPI...

CVE-2024-0625

The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-optionscustomclass’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-29819

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syam Mohan WPFront Notification Bar allows Stored XSS.This issue affects WPFront Notification Bar: from n/a through 3.3.2...

CVE-2021-24518

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24601

The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-29819

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syam Mohan WPFront Notification Bar allows Stored XSS.This issue affects WPFront Notification Bar: from n/a through 3.3.2...

CVE-2024-29819

Technical details about CVE-2024-29819 are not publicly provided in the supplied documents. Monitor for updates.

WordPress Plugin WPFront Notification Bar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-23065

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar versions 3.3.2 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

CVE-2024-29819: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syam Mohan WPFront Notification Bar allows Stored XSS.This issue affects WPFront Notification Bar: from n/a through 3.3.2...

WordPress WPFront Notification Bar Plugin <= 3.3.2 is vulnerable to Cross Site Scripting (XSS)

Software WPFront Notification Bar Type Plugin Vulnerable versions = 3.3.2 Fixed in 3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29819 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bb6b1e52c1e5 Credits Joel Indra Required privilege...