129 matches found
CVE-2026-109513: Improper Neutralization of Input During Web Page Generation
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficien...
PT-2026-115454
Name of the Vulnerable Software and Affected Versions NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar versions prior to 3.3.4 Description Stored Cross-Site Scripting occurs due to insufficient input...
CVE-2026-110721: Missing Authorization
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...
WordPress NotificationX plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability
Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability discovered by jiahao in WordPress Plugin NotificationX versions = 3.3.3...
WordPress NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability
Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability discovered by Eunho Kim in WordPress Plugin NotificationX versions = 3.3.3...
CVE-2026-78563
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2026-78563
...
EUVD-2026-65323
The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...
CVE-2026-78563
CVE-2026-78563 is marked as rejected by NVD, but connected sources (EUVD and PT Security) describe it as a Stored Cross-Site Scripting (XSS) in the NotificationX Pro plugin for WordPress, affecting all versions up to and including 3.1.4 . The root cause is insufficient input sanitization and outp...
PT-2026-81218
Name of the Vulnerable Software and Affected Versions NotificationX Pro versions prior to 3.1.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on...
CVE-2026-68564
Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...
CVE-2026-68564
CVE-2026-68564 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin NotificationX Pro , affecting versions ≤ 3.1.4 . The flaw allows an attacker to inject malicious scripts without prior authentication, though user interaction is required (per the CVSS vector). T...
EUVD-2026-63308
Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...
CVE-2026-68564 WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...
WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin NotificationX Pro versions = 3.1.4...
PT-2026-78981
Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...
CVE-2026-68564: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...
Exploit for SQL Injection in Wpdeveloper Notificationx
CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection...
CVE-2026-27042
Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through = 3.2.1...