CVE-2026-68564

HighCVSS 7.1

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in NotificationX Pro plugin versions up to 3.1.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Risk Assessment

Risk of user data theft, session hijacking, or malware distribution through the injected script.

Recommendation

Update the NotificationX Pro plugin to the latest version that includes a fix eliminating the XSS vulnerability.

Other vulnerabilities in NotificationX Pro

CVE-2026-78563High
The NotificationX Pro plugin for WordPress up to version 3.1.4 is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses an injected page.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.