wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banne vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Latest wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banne vulnerabilities

CVE-2022-51021 — NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint (CVSS 8.2)
CVE-2026-109513 — NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route (CVSS 7.2)
CVE-2026-110721 — NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route (CVSS 5.3)
CVE-2026-27042 — WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2026-0554 — NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset (CVSS 4.3)
CVE-2025-15380 — NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview' (CVSS 7.2)
CVE-2025-22683 — WordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-11727 — NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
CVE-2024-1698 — NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection (CVSS 9.8)
CVE-2020-36744 — NotificationX <= 1.8.2 - Cross-Site Request Forgery Bypass (CVSS 4.3)
CVE-2022-0349 — NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection (CVSS 9.8)