NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar vulnerabilities

Product

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

by wpdevteam · last CVE Oct 16, 2026

CVEs

On KEV

7.2

Max CVSS

New 30D

Vulnerabilities4 In the news0 Timeline

Severity mix

Critical 0High 2Medium 2Low 0

Severity

All severities4 Critical0 High2 Medium2 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-110721	5.3	0%	Oct 16	NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route Affected: through 3.3.3
CVE-2026-0554	4.3	0%	Jan 20	NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset Affected: through 3.1.11