NotificationX Pro EUVD-2026-65323

The CVSS vector (PR:N/AC:L/AV:N/UI:N) indicates no special configuration or authentication is required for the injection step - any internet-reachable WordPress installation running NotificationX Pro through version 3.1.4 is exposed. The plugin must be installed and active on the target site. Exploitation requires two stages: the attacker injects the payload (no authentication required), and a separate user must visit the page where the payload renders (passive browser visit, no further attacker-victim interaction needed). Limiting factors include: the site must have NotificationX Pro installed rather than the free NotificationX version; the attacker needs to identify which input field(s) are vulnerable to storage without sanitization; and meaningful impact scales with the privilege level of users who visit the injected page - an administrator visiting the page yields higher-impact credential theft than a subscriber.

The CVSS base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) is elevated primarily by the unauthenticated attack surface and the scope change to the victim's browser. Real-world priority is meaningful: stored XSS with no authentication requirement on a public-facing WordPress plugin means any internet-reachable site running the plugin is potentially exploitable without any credential. The confidentiality and integrity impacts are rated Low individually (C:L/I:L), but combined session hijacking and page content manipulation can lead to account takeover for authenticated visitors. No EPSS data was provided, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no public POC has been identified - these signals lower urgency compared to a KEV-listed flaw, but the low attack complexity and zero privilege requirement keep it an active remediation priority. No conflicting signals were identified between the CVSS vector and the description: the unauthenticated network-accessible injection path is consistent with PR:N/AV:N.

An unauthenticated attacker submits a crafted HTTP request to a NotificationX Pro input endpoint containing a malicious JavaScript payload - for example, a script designed to exfiltrate session cookies. The payload is stored in the WordPress database without sanitization, and every subsequent visitor who loads the affected page executes the script in their own browser context, allowing the attacker to harvest session tokens or perform actions on behalf of authenticated users. No public proof-of-concept code has been identified at time of analysis, but the low complexity of stored XSS injection against a parameterless, zero-privilege endpoint makes independent exploitation straightforward for any attacker familiar with WordPress plugin internals.