Notificationx Pro
Monthly
Stored Cross-Site Scripting in NotificationX Pro for WordPress (all versions through 3.1.4) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript into site pages, executing in any visitor's browser context. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the combination of zero-privilege access and a scope change impact reaching beyond the WordPress installation itself into the browser sessions of site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface and persistent payload storage make this a credible risk for any site running the affected plugin.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Stored Cross-Site Scripting in NotificationX Pro for WordPress (all versions through 3.1.4) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript into site pages, executing in any visitor's browser context. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the combination of zero-privilege access and a scope change impact reaching beyond the WordPress installation itself into the browser sessions of site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface and persistent payload storage make this a credible risk for any site running the affected plugin.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.