EIP-2026-114276

This is a writeup describing a stored XSS vulnerability in the WordPress plugin WPFront Notification Bar version 1.9.1.04012. The vulnerability allows an attacker to inject malicious JavaScript code into the Custom CSS field, which is then stored in the database and executed when the functionality is triggered.