CVE-2026-109513

The NotificationX WordPress plugin (versions up to and including 3.3.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'name' parameter within the popup-submit REST route . An unauthenticated attacker can inject a...

CVE-2026-109513 NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficien...

CVE-2026-110721

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-110721

The NotificationX plugin for WordPress (versions up to and including 3.3.3 ) is vulnerable to Missing Authorization leading to unauthenticated arbitrary content injection . The /notificationx/v1/popup-submit REST route uses a permission_callback set to __return_true, allowing unauthenticated atta...

EUVD-2026-102642

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-110721 NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

WordPress NotificationX plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability

Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability discovered by jiahao in WordPress Plugin NotificationX versions = 3.3.3...

CVE-2026-6514

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popupsubmit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to...

PT-2026-40899

Name of the Vulnerable Software and Affected Versions InfusedWoo Pro versions prior to 5.1.3 Description The InfusedWoo Pro plugin for WordPress allows unauthenticated attackers to perform Arbitrary File Read via the 'popup submit' endpoint. This allows web requests to be made to arbitrary...