CVE-2026-109513: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress suffers from a stored Cross-Site Scripting (CWE-79) vulnerability in the 'name' parameter. Versions up to and including 3.3.3 do not properly sanitize or escape input, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when users access pages containing the injected content. Exploitation depends on prior administrative configuration involving WordPress.org Reviews campaigns and dynamic blocks placement.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially allowing theft of user credentials, session hijacking, or other malicious actions impacting confidentiality and integrity. The vulnerability does not affect availability. The CVSS 3.1 base score is 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, administrators should avoid enabling WordPress.org Reviews campaigns and placing the notificationx-pro/notificationx dynamic block on public pages to reduce exposure. Applying input sanitization or output escaping manually may mitigate risk but is not a substitute for an official fix.