The NotificationX WordPress plugin is vulnerable to a DOM‑based Cross‑Site Scripting flaw when an attacker can set the 'nx-preview' POST parameter. The plugin fails to sanitize or escape this input, allowing arbitrary JavaScript to be injected into the browser when a user visits a malicious page that auto‑submits the form to the vulnerable site. This flaw permits unauthenticated attackers to run scripts in the context of the WordPress site, potentially leading to data theft, defacement, or session hijacking.

WordPress sites that have installed the NotificationX family of plugins – including the FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar variants – running any version up to and including 3.2.0. All affected instances expose the 'nx-preview' endpoint as part of the preview feature provided by the plugin.

The flaw carries a CVSS score of 7.2, indicating a high-severity vulnerability. The EPSS score is below 1 %, reflecting a low likelihood of exploitation at the time of analysis, and the issue is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw through unauthenticated access by delivering a crafted POST request embedded in a malicious page that automatically sends the data to the site. The vulnerability does not require authentication but relies on a victim visiting the malicious page, after which the injected script executes in the victim’s browser.