EUVD-2026-63308
GHSA-9jrw-m87j-vfwq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS via network with no auth (AV:N/PR:N); victim interaction required (UI:R); scope changes to admin browser (S:C); availability impact assessed as N since XSS does not directly disrupt service.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
AnalysisAI
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector PR:N confirms no authentication is required to submit the malicious payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 is driven primarily by the scope change (S:C) and the network-accessible, zero-authentication attack vector (AV:N/PR:N), but UI:R means a victim must perform some action - such as loading a page containing the malicious notification - for the exploit to trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a crafted input containing a malicious JavaScript payload through a parameter handled by the NotificationX Pro plugin - likely a publicly accessible form or endpoint that populates notification data. The payload is stored or reflected such that when a WordPress administrator views a page rendering that notification, the script executes in the admin's browser, allowing the attacker to exfiltrate the admin's session cookie or silently perform privileged WordPress actions on their behalf. … |
| Remediation | The primary remediation is to update NotificationX Pro to a version above 3.1.4, as the vulnerability was introduced in or before that release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress installations for NotificationX Pro plugin versions 3.1.4 and below; immediately disable or remove the plugin from production unless operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Notificationx Pro
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today