CVE-2026-93896: Syammohanm Wpfront Notification Bar

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Affected products

• Syammohanm Wpfront Notification Bar: up to and including 3.5.1

Published 2026-10-03. Last modified 2026-10-06.