CVE-2026-109513: NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites running NotificationX version 3.3.3 or earlier are exposed only if an administrator has enabled a WordPress.org Reviews campaign and added the notificationx-pro/notificationx dynamic block to a public page.
What access does an attacker need?
No authentication or prior privileges are required. An attacker can use the popup-submit REST route and the name parameter to store malicious script content.
What happens after successful exploitation?
The injected script executes in the browser of users who visit the affected public page. The vulnerability can affect confidentiality and integrity, but the provided data does not indicate an availability impact.
Is the affected setup a supported plugin workflow?
Yes. Enabling a WordPress.org Reviews campaign and placing the dynamic block on a public page are documented, supported NotificationX workflows.