Notificationx Fomo Live Sales Notification Woocommerce Sales Popup Gdpr Social Proof Announcement Banner Floating Notification Bar
Monthly
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Unauthenticated content injection in the WordPress NotificationX plugin (WPDevTeam) - versions up to and including 3.3.3 - allows remote attackers to write forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign by POSTing an arbitrary nx_id to the /notificationx/v1/popup-submit REST route. That route is registered with permission_callback => '__return_true', so no authentication, user interaction, or non-default plugin setting is needed, although exploitation does depend on at least one non-popup campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) already existing and being enabled on the target site. The impact is confined to the integrity of displayed notification content (CVSS 5.3 Medium - no confidentiality or availability loss), no public exploit code has been identified at time of analysis, and the issue is not flagged as actively exploited.
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Unauthenticated content injection in the WordPress NotificationX plugin (WPDevTeam) - versions up to and including 3.3.3 - allows remote attackers to write forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign by POSTing an arbitrary nx_id to the /notificationx/v1/popup-submit REST route. That route is registered with permission_callback => '__return_true', so no authentication, user interaction, or non-default plugin setting is needed, although exploitation does depend on at least one non-popup campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) already existing and being enabled on the target site. The impact is confined to the integrity of displayed notification content (CVSS 5.3 Medium - no confidentiality or availability loss), no public exploit code has been identified at time of analysis, and the issue is not flagged as actively exploited.