EUVD-2026-102678
GHSA-7gph-gw3f-5mr5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site with NotificationX Reviews block on public page
-
DeliverySubmit crafted 'name' value as unauthenticated input
-
ExploitPayload stored without sanitization
-
ExecutionVictim loads injected public page
-
PersistScript executes in victim browser
-
ImpactSession hijack or redirect
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a site administrator has (1) enabled a WordPress.org Reviews campaign in NotificationX and (2) placed the notificationx-pro/notificationx dynamic block on a publicly accessible page - both documented, supported workflows but neither is a default configuration. Given those preconditions, no authentication or user interaction is needed to inject the payload (PR:N/UI:N), and the attack is remotely reachable over the network. The primary limiting factors are these two non-default administrator configuration prerequisites and the stored-XSS nature (impact is browser-side script execution with low confidentiality/integrity effect, not server code execution); sites not running the Reviews campaign with the dynamic block on a public page are not exposed. |
| Impact | Signals are mixed and point to a real-but-conditional, lower-tier priority rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a network-reachable, unauthenticated, low-complexity stored XSS with a scope change and low confidentiality/integrity impact - characteristic of script executing in victims' browsers. However, the description imposes significant non-CVSS preconditions: an administrator must have previously enabled a WordPress.org Reviews campaign AND placed the notificationx-pro/notificationx dynamic block on a public page. These are supported workflows but not default states, which materially narrows the exploitable population and is not reflected in the AC:L / PR:N scoring. There is no KEV listing, no public POC referenced, and no EPSS score provided, so exploitation status is 'no public exploit identified at time of analysis.' Stored XSS in a web-facing plugin is a plausible target for opportunistic abuse, but the required administrator preconfiguration and the limited (low) technical impact - no code execution, no direct admin takeover without chaining - keep real-world risk moderate. Treat as a standard-patch-cycle item: higher priority for sites that actually run WordPress.org Reviews campaigns with the dynamic block on public pages, low priority otherwise. |
| Exploit ScenarioDerived | On a WordPress site where an administrator has enabled a WordPress.org Reviews campaign and embedded the notificationx-pro/notificationx dynamic block on a public page, a remote unauthenticated attacker supplies a malicious payload through the 'name' parameter, which is stored without sufficient sanitization and rendered without proper output escaping. When any visitor or logged-in user loads the affected page, the injected JavaScript executes in their browser session, enabling session/cookie theft, redirection, or defacement. No public exploit code is referenced, and successful exploitation depends on the administrator having the specific campaign and block configuration in place. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
RemediationAI
Upgrade NotificationX to version 3.3.4 or later - this is the vendor-released patch, confirmed by the WordPress.org changeset moving tag 3.3.3 to tag 3.3.4 (https://plugins.trac.wordpress.org/changeset?reponame=&new=3746251%40notificationx%2Ftags%2F3.3.4&old=3720837%40notificationx%2Ftags%2F3.3.3), and refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=cve for tracking. If immediate updating is not possible, apply the following targeted compensating controls, each with a trade-off: (1) disable the WordPress.org Reviews campaign inside NotificationX settings, which removes the required injection precondition but stops the plugin's review-request notifications from being generated; (2) remove the notificationx-pro/notificationx dynamic block (and any NotificationX shortcode) from public-facing pages until patched, trading away the on-site social-proof/FOMO display; (3) restrict who can configure or publish the block to trusted administrators only, which reduces future exposure but does not remediate the underlying sanitization flaw; and (4) deploy virtual patching via a WAF rule that blocks script-bearing values submitted to NotificationX's REST endpoint (includes/Core/Rest/Popup.php) and filters suspicious markup in the 'name' parameter - effective only while the signature stays current. Because exploitation is possible without authentication once the two administrator-side preconditions exist, prioritize upgrading on any site currently running the Reviews campaign with the dynamic block on a public page; sites not using that configuration are not exposed and can update on a normal maintenance cadence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. stored/persistent cross-site scripting) in the WordPress plugin 'NotificationX - FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar', published by wpdevteam and matched by CPE cpe:2.3:a:wpdevteam:notificationx_-_fomo,_live_sales_notification,_woocommerce_sales_popup,_gdpr,_social_proof,_announcement_banner_&_floating_notification_bar. The 'name' field supplied to the plugin's Reviews/notification data pipeline is neither sanitized on input nor escaped on output before being rendered into the page, so attacker-controlled markup is persisted and later emitted as executable script. The referenced source locations trace the data path across the plugin's block registration (blocks/Blocks.php), inline shortcode rendering (includes/Features/ShortcodeInline.php), the WordPress.org Reviews campaign extension (includes/Extensions/WordPress/WPOrgReview.php), the REST controller for popup notifications (includes/Core/Rest/Popup.php), and the popup notification renderer (includes/Extensions/PopupNotification/PopupNotification.php) - indicating the tainted value flows from a REST-reachable write path into front-end block/shortcode/popup output. The CVSS scope is changed (S:C), reflecting that script execution crosses from the plugin's trusted component into the broader WordPress page/site origin context, though the assessed impact remains limited to low confidentiality and low integrity (C:L/I:L) with no availability effect (A:N), i.e. browser-side script execution rather than server compromise.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable stored XSS (PR:N/AV:N); script executes in victims' browsers across a security boundary (S:C) with low C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The NotificationX - FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
Executive ViewAI
A stored cross-site scripting vulnerability in the NotificationX WordPress plugin (all versions up to and including 3.3.3) allows unauthenticated attackers to inject JavaScript that executes in the browsers of visitors loading an affected page. Exposure is real but conditional: it requires an administrator to have enabled the WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration, so only a subset of sites running this plugin are at risk. No exploitation has been observed and no public exploit code exists, but because the flaw is unauthenticated and visitor-facing, leadership should ensure affected sites are inventoried and upgraded to version 3.3.4 promptly rather than treating this as an emergency.
Apply vendor patch (upgrade to version 3.3.4 or later). Where immediate upgrade is not possible, disable the WordPress.org Reviews campaign and remove or unpublish the notificationx-pro/notificationx dynamic block from all publicly reachable pages, and restrict who can place dynamic blocks until the plugin is updated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB