NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar vulnerabilities

Product

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

by wpdevteam · last CVE Oct 16, 2026

CVEs

On KEV

7.2

Max CVSS

New 30D

Vulnerabilities2 In the news0 Timeline

Severity mix

Critical 0High 1Medium 1Low 0

Severity

All severities2 Critical0 High1 Medium1 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-109513	7.2	0%	Oct 16	NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route Affected: through 3.3.3
CVE-2026-110721	5.3	0%	Oct 16	NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route Affected: through 3.3.3