NotificationX <= 2.8.2 - SQL Injection

The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and la...

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress プラグインの SQL インジェクション（時間ベースのブラインド） 認証なしの時間ベース・ブラインドSQLインジェクション → WordPress管理者のユーザー名とパスワードハッシュを抽出。 🧠 脆弱性の概要 NotificationX のバージョン 2.8.2以下 は、REST APIエンドポイントの type パラメータにおける入力サニタイズ不備の影響を受けます： /wp-json/notificationx/v1/analytics...

CVE-2019-1698

TRAN CONG DANH - SVTT - メンター: LUU VAN LAN - CVE-2019-1698 - 開始日: 30/07/2024 脆弱性のあるバージョンと修正済みバージョンのコード差分を確認する: コード参照 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php コード参照 2:...

WordPress-NotificationX-CVE-2024-1698

설정 root@kitploit: docker-compose up --build 정리 root@kitploit: docker-compose down 테스트 root@kitploit: Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null--...

CVE-2024-1698-Exploit

CVE-2024-1698 エクスプロイトスクリプト - WordPress NotificationX = 2.8.2 - SQLインジェクション これは、CVE-2024-1698を悪用してWordPress管理者のユーザー名とパスワードハッシュを特定するためのエクスプロイトスクリプトです。 このPythonスクリプトは教育目的のみを意図しています。WordPressサイトのNotificationX Analytics APIにおけるCVE-2024-1698...

CVE-2026-78563

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-78563

CVE-2026-78563 is marked as rejected by NVD, but connected sources (EUVD and PT Security) describe it as a Stored Cross-Site Scripting (XSS) in the NotificationX Pro plugin for WordPress, affecting all versions up to and including 3.1.4 . The root cause is insufficient input sanitization and outp...

EUVD-2026-65323

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

CVE-2026-78563

...

CVE-2026-78563

...

PT-2026-81218

Name of the Vulnerable Software and Affected Versions NotificationX Pro versions prior to 3.1.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on...

CVE-2026-68564

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

EUVD-2026-63308

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

CVE-2026-68564 WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

CVE-2026-68564

CVE-2026-68564 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin NotificationX Pro , affecting versions ≤ 3.1.4 . The flaw allows an attacker to inject malicious scripts without prior authentication, though user interaction is required (per the CVSS vector). T...

Exploit for SQL Injection in Wpdeveloper Notificationx

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection...

CVE-2026-27042

Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through = 3.2.1...

CVE-2026-27042

Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through = 3.2.1...