# NotificationX <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Countdown Widget Expiry Message

- **ID:** WPSEC-2026-1552
- **Plugin:** NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (`notificationx`), https://wordpress.org/plugins/notificationx/
- **Affected versions:** from 3.2.7 before 3.3.5
- **Fixed in:** 3.3.5 (Update to 3.3.5 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/notificationx
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1552/

## Description

The NotificationX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the expiry title and text settings of the Elementor Countdown widget in all versions up to, and including, 3.3.4, due to insufficient output escaping. The sanitized expiry message was placed in HTML data attributes, where the browser decodes entity-encoded markup, and the countdown script then inserted it into the page with jQuery .html() when the countdown expired. This makes it possible for authenticated attackers, with contributor-level access and above and permission to use the Elementor editor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page after the countdown has expired.

## References

- https://wpsec.com/vuln/WPSEC-2026-1552/
- https://plugins.svn.wordpress.org/notificationx/tags/3.3.5/
- https://wordpress.org/plugins/notificationx/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1552/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.