CVE-2025-31610 | THREATINT

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme allows Stored XSS. This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through 1.1.

Reserved 2025-03-31 | Published 2025-03-31 | Updated 2025-03-31 | Assigner Patchstack

MEDIUM: 5.9CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

unaffected

Any version

affected

Credits

Pham Van Tam (Patchstack Alliance) finder

References

patchstack.com/...site-scripting-xss-vulnerability?_s_id=cve vdb-entry

cve.org (CVE-2025-31610)

nvd.nist.gov (CVE-2025-31610)

Download JSON