{
 "id": "WPSEC-2026-2205",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2205/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2205/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2205/index.md",
 "title": "NotificationX <= 3.3.6 - Unauthenticated Sensitive Information Exposure and Arbitrary Shortcode Execution via Preview Mode",
 "description": "The NotificationX plugin for WordPress is vulnerable to Sensitive Information Exposure and Arbitrary Shortcode Execution via the 'nx-preview' preview mode in all versions up to, and including, 3.3.6. This is due to missing authorization and nonce checks on requests that carry an 'nx-preview' payload. The base64-encoded JSON settings in that payload are used as notification bar settings and rendered into the front-end page, and bar content is rendered from any post ID without checking its type, status or password. This makes it possible for unauthenticated attackers to read the content of draft, private or password-protected posts by referencing their IDs, and to execute arbitrary shortcodes supplied in the request.",
 "plugin": {
  "slug": "notificationx",
  "name": "NotificationX",
  "full_name": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar",
  "wordpress_org": "https://wordpress.org/plugins/notificationx/",
  "advisories_url": "https://wpsec.com/vuln/plugin/notificationx/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/notificationx"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.7",
 "remediation": "Update to 3.3.7 or later.",
 "fix_released": "2026-11-02T06:49:50+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:52.243752+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2205/",
  "https://plugins.svn.wordpress.org/notificationx/tags/3.3.7/",
  "https://wordpress.org/plugins/notificationx/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/notificationx",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}