Notificationx Vulnerabilities

The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and including, 3.1.11. This makes it possible for authenticated attackers, with Contributor-level access and above, to res...

CVSS:

4.3

Affected:

up to 3.1.11

Fixed in:

3.2.1

Disclosed:

Jan 20, 2026

CVE-2026-0554 on NVD →

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'nx-preview' POST parameter in all versions up to, and including, 3.2.0. This is due to insufficien...

CVSS:

7.2

Affected:

up to 3.2.0

Fixed in:

3.2.1

Disclosed:

Jan 20, 2026

CVE-2025-15380 on NVD →

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.1. This makes it possible fo...

CVSS:

5.3

Affected:

up to 3.2.1

Fixed in:

3.2.2

Disclosed:

Jan 15, 2026

CVE-2026-27042 on NVD →

The NotificationX plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th...

CVSS:

6.4

Affected:

up to 2.9.5

Fixed in:

3.0.0

Disclosed:

Jan 31, 2025

CVE-2025-22683 on NVD →

The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content settings for notifications in all versions up to, and including, 2.9.3 due to insuffici...

CVSS:

4.4

Affected:

up to 2.9.3

Fixed in:

2.9.4

Disclosed:

Dec 11, 2024

CVE-2024-11727 on NVD →

The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar...

CVSS:

9.8

Affected:

up to 2.8.2

Fixed in:

2.8.3

Disclosed:

Feb 26, 2024

CVE-2024-1698 on NVD →

The NotificationX plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter found within the notificationx/v1/notification REST endpoint in versions up to, and including, 2.3.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL qu...

CVSS:

7.5

Affected:

up to 2.3.11

Fixed in:

2.3.12

Disclosed:

Feb 28, 2022

The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection.

CVSS:

9.8

Affected:

up to 2.3.8

Fixed in:

2.3.9

Disclosed:

Feb 2, 2022

CVE-2022-0349 on NVD →

The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect nonce validation on the generate_conversions() function. This makes it possible for unauthenticated attackers to generate conversions via a forged request grant...

CVSS:

4.3

Affected:

up to 1.8.3

Fixed in:

1.8.3

Disclosed:

Sep 16, 2020

CVE-2020-36744 on NVD →