CVE-2026-78563

HighCVSS 7.2

Published: 25/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The NotificationX Pro plugin for WordPress up to version 3.1.4 is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses an injected page.

Risk Assessment

An attacker could inject malicious scripts that execute in users' browsers, potentially leading to data theft, session hijacking, or other XSS attacks.

Recommendation

Update the NotificationX Pro plugin to the latest version that includes security fixes. Additionally, apply the principle of least privilege and regularly audit plugins.

Other vulnerabilities in NotificationX Pro

CVE-2026-68564High
Unauthenticated Cross Site Scripting (XSS) vulnerability in NotificationX Pro plugin versions up to 3.1.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Original NVD description (English source)

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.