CVE-2024-1698-Exploit

CVE-2024-1698 Exploit Script - Wordpress NotificationX = 2.8.2 - SQL Injection This is an exploit script to find out wordpress admin's username and password hash by exploiting CVE-2024-1698. This Python script is intended for educational purposes only. It demonstrates a proof of concept for...

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...

CVE-2026-109513

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficien...

EUVD-2026-102678

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficien...

CVE-2026-109513 NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficien...

CVE-2026-109513

The NotificationX WordPress plugin (versions up to and including 3.3.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'name' parameter within the popup-submit REST route . An unauthenticated attacker can inject a...

CVE-2026-110721

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

EUVD-2026-102642

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-110721 NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-110721

The NotificationX plugin for WordPress (versions up to and including 3.3.3 ) is vulnerable to Missing Authorization leading to unauthenticated arbitrary content injection . The /notificationx/v1/popup-submit REST route uses a permission_callback set to __return_true, allowing unauthenticated atta...

NotificationX <= 2.8.2 - SQL Injection

The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and la...

WordPress NotificationX plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability

Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability discovered by jiahao in WordPress Plugin NotificationX versions = 3.3.3...

WordPress NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability discovered by Eunho Kim in WordPress Plugin NotificationX versions = 3.3.3...

WordPress-NotificationX-CVE-2024-1698

Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

CVE-2026-78563

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

EUVD-2026-65323

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

CVE-2026-78563

CVE-2026-78563 is marked as rejected by NVD, but connected sources (EUVD and PT Security) describe it as a Stored Cross-Site Scripting (XSS) in the NotificationX Pro plugin for WordPress, affecting all versions up to and including 3.1.4 . The root cause is insufficient input sanitization and outp...