Description

Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:36.190Z",
  "pubdate": "2026-08-20T12:16:36.190Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the NotificationX Pro plugin. This security flaw enables remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered to unsuspecting users visiting the affected WordPress site.\nThe vulnerability affects NotificationX Pro versions 3.1.4 and below. The primary risk implications include potential session hijacking, arbitrary redirection to malicious domains, defacement of the web application, and the execution of unauthorized actions within the context of a victim's browser session.\nBecause the attack vector is unauthenticated, exploitation requires no prior access credentials or user privileges on the target platform. An attacker can craft a malicious HTTP request containing the payload and induce a user to load the compromised resource, thereby triggering script execution.\nThe combination of unauthenticated access, client-side script execution, and potential administrative session compromise presents a high-severity risk to the confidentiality, integrity, and availability of the affected web application and its user base.",
  "technicalDetails": "The vulnerability resides within the input handling mechanisms of the NotificationX Pro plugin for WordPress, specifically affecting versions 3.1.4 and prior. The root cause stems from insufficient sanitization and output encoding of user-supplied data before it is reflected back in the Document Object Model (DOM) of the application.\nThis flaw manifests as a reflected or stored Cross-Site Scripting vulnerability where malicious payloads bypass validation filters and are subsequently processed by the server and rendered to the client. The vulnerable component fails to properly neutralize executable HTML or JavaScript tags within incoming requests.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious URI or HTTP request containing a serialized or direct JavaScript payload designed to execute within a victim's browser. Second, the attacker induces a target user or administrator to interact with the malicious link via social engineering or other delivery mechanisms. Third, the application processes the input and embeds the unsanitized payload into the HTTP response returned to the client browser.\nUpon receiving the response, the victim's browser interprets the injected payload as legitimate application code and executes it within the security context of the origin site. Because the execution occurs in the browser, the payload inherits the session privileges of the victim. If the victim happens to hold administrative privileges, the attacker can leverage this execution to create new administrative accounts, modify plugin configurations, or inject persistent malware into the database.\nNetwork exposure is fully external, as the vulnerable endpoint is accessible over standard HTTP/HTTPS protocols without requiring authentication tokens, cookies, or prior session establishment. The prerequisite for exploitation is simply network reachability to the vulnerable WordPress instance running the affected versions of NotificationX Pro."
}