NotificationX Pro EUVD-2026-63308

The CVSS vector PR:N confirms no authentication is required to submit the malicious payload. However, UI:R means successful exploitation requires an authenticated user - most likely a WordPress administrator - to load the page or UI element where the injected script is rendered. Exploitation is therefore not fully autonomous: the attacker must cause or wait for an admin to trigger the payload. The S:C scope change confirms the script executes in the victim's browser context rather than being contained to the plugin sandbox. Limiting factors include the requirement for victim interaction (UI:R), the need for the site to have NotificationX Pro version 3.1.4 or earlier installed and active, and the requirement that an administrative or privileged session be active when the payload fires.

The CVSS 3.1 base score of 7.1 is driven primarily by the scope change (S:C) and the network-accessible, zero-authentication attack vector (AV:N/PR:N), but UI:R means a victim must perform some action - such as loading a page containing the malicious notification - for the exploit to trigger. EPSS data was not provided in the intelligence sources, so exploitation probability cannot be quantified. No CISA KEV listing is present, and no public proof-of-concept exploit was identified. The real-world risk is meaningful but not immediately critical: the limited per-component impact ratings (C:L/I:L/A:L) reflect that XSS alone does not directly compromise the server, and successful exploitation depends on an authenticated user (typically an admin) encountering the injected payload. Because WordPress admin accounts control the entire site, admin session hijacking via stored XSS should be treated as a high-priority finding despite the moderate impact ratings. Organizations running NotificationX Pro at or below version 3.1.4 should patch promptly; the low attack complexity and lack of authentication requirement mean any internet-exposed WordPress site with this plugin installed is a viable target.

An unauthenticated attacker submits a crafted input containing a malicious JavaScript payload through a parameter handled by the NotificationX Pro plugin - likely a publicly accessible form or endpoint that populates notification data. The payload is stored or reflected such that when a WordPress administrator views a page rendering that notification, the script executes in the admin's browser, allowing the attacker to exfiltrate the admin's session cookie or silently perform privileged WordPress actions on their behalf. No public proof-of-concept code was identified at time of analysis, but the low attack complexity makes independent rediscovery straightforward.