NotificationX <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block Expiry Title and Text
- ID
- WPSEC-2026-1551
- Plugin
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (notificationx)
- Affected
- from 3.2.10 before 3.3.5
- Remediation
- Update to 3.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- NotificationX on WPSec AttackSurface
- Fix released
- Published
Description
The NotificationX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'expiryTitle' and 'expiryText' attributes of the Countdown block in all versions up to, and including, 3.3.4, due to insufficient output escaping. The sanitized expiry message was placed in HTML data attributes using esc_attr(), which does not re-encode existing entities, so the browser decoded entity-encoded markup. The block's frontend script then wrote that value to the page with innerHTML when the countdown expired. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page after the countdown has expired.
References
- https://wpsec.com/vuln/WPSEC-2026-1551/
- https://plugins.svn.wordpress.org/notificationx/tags/3.3.5/
- https://wordpress.org/plugins/notificationx/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS