NotificationX EUVD-2026-102678

Exploitation requires that a site administrator has (1) enabled a WordPress.org Reviews campaign in NotificationX and (2) placed the notificationx-pro/notificationx dynamic block on a publicly accessible page - both documented, supported workflows but neither is a default configuration. Given those preconditions, no authentication or user interaction is needed to inject the payload (PR:N/UI:N), and the attack is remotely reachable over the network. The primary limiting factors are these two non-default administrator configuration prerequisites and the stored-XSS nature (impact is browser-side script execution with low confidentiality/integrity effect, not server code execution); sites not running the Reviews campaign with the dynamic block on a public page are not exposed.

Signals are mixed and point to a real-but-conditional, lower-tier priority rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a network-reachable, unauthenticated, low-complexity stored XSS with a scope change and low confidentiality/integrity impact - characteristic of script executing in victims' browsers. However, the description imposes significant non-CVSS preconditions: an administrator must have previously enabled a WordPress.org Reviews campaign AND placed the notificationx-pro/notificationx dynamic block on a public page. These are supported workflows but not default states, which materially narrows the exploitable population and is not reflected in the AC:L / PR:N scoring. There is no KEV listing, no public POC referenced, and no EPSS score provided, so exploitation status is 'no public exploit identified at time of analysis.' Stored XSS in a web-facing plugin is a plausible target for opportunistic abuse, but the required administrator preconfiguration and the limited (low) technical impact - no code execution, no direct admin takeover without chaining - keep real-world risk moderate. Treat as a standard-patch-cycle item: higher priority for sites that actually run WordPress.org Reviews campaigns with the dynamic block on public pages, low priority otherwise.

On a WordPress site where an administrator has enabled a WordPress.org Reviews campaign and embedded the notificationx-pro/notificationx dynamic block on a public page, a remote unauthenticated attacker supplies a malicious payload through the 'name' parameter, which is stored without sufficient sanitization and rendered without proper output escaping. When any visitor or logged-in user loads the affected page, the injected JavaScript executes in their browser session, enabling session/cookie theft, redirection, or defacement. No public exploit code is referenced, and successful exploitation depends on the administrator having the specific campaign and block configuration in place.