Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

WP Notification Bell can let attackers run scripts

CVE-2025-58821 · published 1 year ago
Summary

The WP Notification Bell add‑on for WordPress can be tricked into saving malicious code that runs in a visitor’s web browser. This means a bad actor could steal information or take control of a user’s session when they view a page containing the crafted notification. Install the latest version of the add‑on (or remove it if you cannot update) to stop the problem.

Original advisory text
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows Stored XSS.This issue affects WP Notif...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows Stored XSS.This issue affects WP Notification Bell: from n/a through <= 1.4.6.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-58821 · NVD
Track software like this
Free during beta