{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anotificationxnotificationxwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:notificationx:notificationx:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109513"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NotificationX (\u003c= 3.3.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe NotificationX plugin for WordPress (versions 3.3.3 and earlier) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping within the 'name' parameter. This flaw allows unauthenticated attackers to inject malicious scripts into the application. The vulnerability is triggered when an administrator enables a WordPress.org Reviews campaign and utilizes the 'notificationx-pro/notificationx' dynamic block on a public-facing page. If successful, the injected script executes in the context of the user viewing the impacted page, potentially leading to unauthorized actions, session hijacking, or credential theft. This vulnerability is particularly impactful because the injection vector exists within a standard, documented plugin workflow.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated attackers to achieve Stored XSS, which can be leveraged to execute arbitrary JavaScript in the browsers of users viewing the compromised notification. This can result in session token theft, unauthorized administrative actions, or the redirection of users to malicious domains. Given the nature of notification plugins, victims may include site administrators and customers, increasing the potential for account takeover or large-scale user impact depending on the site traffic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the NotificationX plugin to the latest version, which includes patches for the input sanitization flaw in the name parameter.\u003c/li\u003e\n\u003cli\u003eAudit all pages currently utilizing the 'notificationx-pro/notificationx' dynamic block for signs of unauthorized script injection.\u003c/li\u003e\n\u003cli\u003eReview administrative configurations for the WordPress.org Reviews campaign to ensure that dynamic blocks are not exposed unnecessarily if not actively managed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:26:56Z","date_published":"2026-10-16T06:26:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109513/","summary":"The NotificationX plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the name parameter, allowing unauthenticated attackers to execute arbitrary web scripts.","title":"Stored Cross-Site Scripting in NotificationX Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109513/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:notificationx:notificationx:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}