CVE-2026-109513

HighCVSS 7.2

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The NotificationX plugin for WordPress (versions up to and including 3.3.3) is vulnerable to stored Cross-Site Scripting via the 'name' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

Risk Assessment

Exploitation requires an administrator to have previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, potentially leading to code execution in the user's browser.

Recommendation

Update the NotificationX plugin to a version later than 3.3.3 or disable it; consider disabling the WordPress.org Reviews campaign and removing the dynamic block from public pages.

Other vulnerabilities in NotificationX

CVE-2026-110721Medium
The NotificationX plugin for WordPress in versions up to and including 3.3.3 is vulnerable to Missing Authorization leading to arbitrary content injection. The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads the referenced NotificationX campaign, and copies its source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup.

Original NVD description (English source)

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS