Stored Cross-Site Scripting in NotificationX Plugin

The NotificationX plugin for WordPress (versions 3.3.3 and earlier) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping within the 'name' parameter. This flaw allows unauthenticated attackers to inject malicious scripts into the application. The vulnerability is triggered when an administrator enables a WordPress.org Reviews campaign and utilizes the 'notificationx-pro/notificationx' dynamic block on a public-facing page. If successful, the injected script executes in the context of the user viewing the impacted page, potentially leading to unauthorized actions, session hijacking, or credential theft. This vulnerability is particularly impactful because the injection vector exists within a standard, documented plugin workflow.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to achieve Stored XSS, which can be leveraged to execute arbitrary JavaScript in the browsers of users viewing the compromised notification. This can result in session token theft, unauthorized administrative actions, or the redirection of users to malicious domains. Given the nature of notification plugins, victims may include site administrators and customers, increasing the potential for account takeover or large-scale user impact depending on the site traffic.

Recommendation

• Update the NotificationX plugin to the latest version, which includes patches for the input sanitization flaw in the name parameter.
• Audit all pages currently utilizing the 'notificationx-pro/notificationx' dynamic block for signs of unauthorized script injection.
• Review administrative configurations for the WordPress.org Reviews campaign to ensure that dynamic blocks are not exposed unnecessarily if not actively managed.