CVE-2026-9577 in Post Status Notifier Lite Plugin
Summary
by MITRE • 07/23/2026
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The Post Status Notifier Lite WordPress plugin version 1.12.9 and earlier contains a critical reflected cross-site scripting vulnerability that arises from improper input sanitization within its administrative interface. This flaw exists in the handling of the mod URL parameter when users navigate to the admin settings page at admin.php?page=post-status-notifier-lite, creating an attack vector that can be exploited by malicious actors to execute arbitrary scripts within the context of an administrator's browser session.
The technical implementation of this vulnerability stems from the plugin's failure to properly escape or sanitize user-controllable input before incorporating it into the HTML output of the administrative interface. When an administrator visits a specially crafted URL containing a malicious mod parameter, the plugin reflects this unvalidated input directly into the page source without appropriate HTML escaping or encoding mechanisms. This creates a classic reflected XSS scenario where the malicious payload executes in the administrator's browser when they interact with the compromised page.
The operational impact of this vulnerability is severe as it enables attackers to potentially escalate privileges and gain full administrative control over affected WordPress installations. An attacker could craft malicious URLs that, when clicked by an administrator, would execute scripts such as stealing session cookies, modifying plugin settings, creating new admin users, or even uploading malware. The vulnerability specifically targets the administrative context, making it particularly dangerous since successful exploitation would grant attackers the same privileges and access rights as legitimate administrators within the WordPress environment.
The vulnerability aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and follows ATT&CK technique T1566.002 - Phishing: Spearphishing Attachment for initial compromise. This represents a significant risk to WordPress installations using the affected plugin version, as administrators are typically trusted users with elevated privileges that make successful exploitation particularly damaging. The reflected nature of the vulnerability means that attacks can be delivered through various vectors including email phishing campaigns, compromised websites, or social engineering tactics where victims are tricked into visiting malicious URLs containing crafted mod parameters.
Organizations should immediately update to version 1.13.0 or later of the Post Status Notifier Lite plugin to remediate this vulnerability and ensure that all administrators are protected from potential exploitation attempts. Additionally, network security measures such as web application firewalls and monitoring for suspicious URL patterns may provide additional layers of defense against exploitation attempts targeting this specific reflected XSS flaw.