NotificationX <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Countdown Widget Expiry Message
- ID
- WPSEC-2026-1552
- Plugin
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (notificationx)
- Affected
- from 3.2.7 before 3.3.5
- Remediation
- Update to 3.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- NotificationX on WPSec AttackSurface
- Fix released
- Published
Description
The NotificationX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the expiry title and text settings of the Elementor Countdown widget in all versions up to, and including, 3.3.4, due to insufficient output escaping. The sanitized expiry message was placed in HTML data attributes, where the browser decodes entity-encoded markup, and the countdown script then inserted it into the page with jQuery .html() when the countdown expired. This makes it possible for authenticated attackers, with contributor-level access and above and permission to use the Elementor editor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page after the countdown has expired.
References
- https://wpsec.com/vuln/WPSEC-2026-1552/
- https://plugins.svn.wordpress.org/notificationx/tags/3.3.5/
- https://wordpress.org/plugins/notificationx/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS