CVE-2026-93896: WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (writedebuglogs) reflecting the raw value of $SERVER['REQUESTURI'] through vprintf() directly inside a <script> block emitted on wpfooter, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can supply a crafted URL containing malicious script content in the request URI. Exploitation requires persuading a victim to visit or interact with that crafted link.
What application condition is required for the payload to execute?
The vulnerable debug-log output path must run and emit the unescaped request URI in a script block on the page footer. The provided information identifies this path as write_debug_logs, associated with the URL-text display filter.
Which versions are affected?
WPFront Notification Bar versions up to and including 3.5.1 are affected. The supplied data does not identify a fixed version.