CVE-2026-110721
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The NotificationX plugin for WordPress in versions up to and including 3.3.3 is vulnerable to Missing Authorization leading to arbitrary content injection. The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads the referenced NotificationX campaign, and copies its source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup.
Risk Assessment
An unauthenticated attacker can inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign, such as WP Comments, WooCommerce/EDD/Give sales, or reviews.
Recommendation
Update the NotificationX plugin to a version later than 3.3.3.
Other vulnerabilities in NotificationX
Original NVD description (English source)
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS