User Notes Vulnerabilities

The User Notes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

4.4

Affected:

up to 1.0.2

Fixed in:

1.0.3

Disclosed:

Sep 26, 2025

CVE-2025-60136 on NVD →

The User Notes plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including 1.0.1, due to insufficient input sanitization and output escaping on the 'user_notes_note' parameter. This makes it possible for users with access to add user notes to inject malicious web scripts that could execu...

CVSS:

6.4

Affected:

up to 1.0.1

Fixed in:

1.0.2

Disclosed:

Apr 12, 2021