WordPress NotificationX plugin < 3.3.7 - Unauthenticated Settings Update and Email Sending vulnerability

Unauthenticated Settings Update and Email Sending vulnerability discovered by Kevin Whelan in WordPress Plugin NotificationX versions 3.3.7...

CVE-2026-119507

The NotificationX plugin for WordPress (versions up to and including 3.3.6 ) is vulnerable to an Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80), leading to a Basic XSS content injection. This vulnerability allows for Code Injection within the web page. No specific reme...

CVE-2026-119507 WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6...

CVE-2026-119507 WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6...

WordPress NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability discovered by Eunho Kim in WordPress Plugin NotificationX versions = 3.3.3...

WordPress NotificationX authorization issue vulnerability

WordPress NotificationX versions 3.3.3 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of authorization verification. The permission callback for REST routes/notificationx/v1/popup-submit returns true, and the activity type corresponding to the nx...

WordPress NotificationX Cross-Site Script Vulnerability

WordPress NotificationX versions 3.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from stored-xss attacks via the ‘name’ parameter. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts, which wi...

CVE-2025-22683 WordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through = 2.9.5...

WordPress NotificationX Plugin <= 2.8.2 is vulnerable to SQL Injection

Software NotificationX Type Plugin Vulnerable versions = 2.8.2 Fixed in 2.8.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1698 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 7d9025b61012 Credits Krzysztof Zając Required privilege Unauthenticated...