CVE-2026-68564: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in NotificationX NotificationX Pro

CVE-2026-68564 is an unauthenticated cross-site scripting (XSS) vulnerability identified in NotificationX Pro versions up to 3.1.4. The flaw is due to improper neutralization of input during web page generation, classified under CWE-79. The vulnerability has a CVSS v3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Successful exploitation can lead to partial confidentiality, integrity, and availability impacts.

Exploitation of this vulnerability can allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application. This can lead to partial compromise of confidentiality, integrity, and availability of the application or its data. The vulnerability requires user interaction but no privileges, and it can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Implementing web application firewalls (WAF) with XSS filtering may provide temporary mitigation, but reliance on such measures is not a substitute for a vendor-provided patch.