CVE-2024-1698-Exploit

CVE-2024-1698 Exploit Script - Wordpress NotificationX = 2.8.2 - SQL Injection This is an exploit script to find out wordpress admin's username and password hash by exploiting CVE-2024-1698. This Python script is intended for educational purposes only. It demonstrates a proof of concept for...

WordPress NotificationX plugin < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution vulnerability

Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution vulnerability discovered by vuxvinh in WordPress Plugin NotificationX versions 3.3.7...

CVE-2026-119302

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

CVE-2026-119302

The NotificationX WordPress plugin (versions prior to 3.3.7 ) is vulnerable to unauthenticated non-public content disclosure and arbitrary shortcode execution . The root cause is a lack of capability, authentication, or nonce checks on the plugin's notification preview path . This allows unauthen...

EUVD-2026-123276

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

CVE-2026-119302 NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

CVE-2026-119303

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

CVE-2026-119303

The NotificationX WordPress plugin (versions before 3.3.7 ) is vulnerable to an unauthenticated settings update and email flooding due to a lack of capability or nonce checks on a specific REST route (identified as send-rating). This allows unauthenticated attackers to modify plugin options and r...

WordPress NotificationX plugin < 3.3.7 - Unauthenticated Settings Update and Email Sending vulnerability

Unauthenticated Settings Update and Email Sending vulnerability discovered by Kevin Whelan in WordPress Plugin NotificationX versions 3.3.7...

CVE-2026-119303 NotificationX < 3.3.7 - Unauthenticated Settings Update and Email Sending via send-rating REST Route

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

EUVD-2026-123181

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

NotificationX <= 2.8.2 - SQL Injection

The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and la...

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

PT-2026-145017

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

CVE-2026-119303: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST…

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

WordPress-NotificationX-CVE-2024-1698

Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...

CVE-2026-119507

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6...