CVE-2026-109513 in NotificationX Plugin
Summary
by MITRE • 10/16/2026
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The NotificationX plugin for WordPress, specifically versions up to 3.3.3, contains a critical stored cross-site scripting vulnerability within its handling of user-supplied input via the name parameter. This flaw stems from insufficient input sanitization and output escaping mechanisms that fail to properly validate or encode data before it is processed by the application logic. The security deficiency allows unauthenticated attackers to inject arbitrary web scripts into pages managed by the plugin, which are then executed in the context of any user who views the affected page.
The operational impact of this vulnerability is significant because it does not require prior authentication for exploitation, provided that specific administrative configurations have been made. Specifically, an administrator must have enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public-facing page. These are standard, documented workflows within the plugin, meaning that many installations may be inadvertently vulnerable if these features are active. Once exploited, the injected scripts execute in the browsers of visitors to the site, potentially leading to session hijacking, credential theft, defacement, or further malware distribution depending on the payload delivered by the attacker.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector leverages stored persistence, where malicious content is saved in the application's database or configuration and served to multiple victims over time. In terms of tactical mapping under MITRE ATT&CK for Enterprise, this behavior corresponds to T1059 Command and Scripting Interpreter through JavaScript execution within a web browser context, facilitating initial access and potential lateral movement if combined with other exploits targeting authenticated sessions.
Mitigation strategies should prioritize immediate remediation by upgrading the NotificationX plugin to version 3.3.4 or later where these sanitization issues have been addressed. Administrators who cannot immediately upgrade should consider disabling the WordPress.org Reviews campaign feature and removing the notificationx-pro/notificationx dynamic block from public pages until a patch is applied. Additionally, implementing a Web Application Firewall with robust XSS detection rules can provide an additional layer of defense by filtering malicious payloads before they reach the application logic or are rendered in user browsers. Regular security audits and adherence to secure coding practices that enforce strict input validation and output encoding are essential for preventing similar vulnerabilities in future updates.