JavaScript Notifier

JavaScript Notifier has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for JavaScript Notifier has a vendor fix available, so running the current release closes it.

All of these findings were reported by 0x34rth. JavaScript Notifier is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

4.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all JavaScript Notifier vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.4CVE-2026-1191

JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

Read the full analysis

Vulnerability Records

1 records


2026-01-23 20:32	JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings JavaScript Notifier <= 1.2.8	`CVE-2026-1191`	4.4 Medium	0x34rth	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv1.2.9

JavaScript Notifier

Author

freemp

5.0(2)

100/100

Last Updated

2026-08-21 (23d ago)

Active Installs

60+

Downloads

2,703

Requires WP

3.8+

Requires PHP

Tested up to

WP 7.1

Created

2018-05-26 (8y ago)

A simple, lightweight WordPress plugin for displaying a notification bar at the top of the webpage if 1st-party JavaScript is disabled. If appropriate, the entire website may as well be blocked by a full-page overlay instead of just a small bar. The plugin offers configuration of background and foreground color, opacity, notification message text and font size. Individual customization by means of CSS snippets is also supported.

View on WordPress.org