The NotificationX plugin is vulnerable to stored Cross‑Site Scripting triggered through the 'name' parameter in all releases up to 3.3.3. Input from unauthenticated clients is accepted by a popup‑submission REST route and then persisted without proper sanitization or escaping. When a page containing the notificationx‑pro/notificationx block is viewed, the malicious script executes in the context of that site, potentially compromising user data or gaining session information. The flaw is a classic CWE‑79 case of insufficient output encoding, enabling arbitrary script injection.

WordPress sites running NotificationX versions 3.3.3 or earlier, including the variants FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner, and Floating Notification Bar. The vulnerability requires that the administrator has enabled a WordPress.org Reviews campaign and embedded the dynamic block on a publicly accessible page, both of which are supported plugin configurations.

With a CVSS base score of 7.2, this vulnerability is considered high severity. Since no EPSS score is available and the issue is not in CISA KEV, the exploitation probability is uncertain but the attack surface is broad—any unauthenticated user can send crafted requests to the REST route. The attacker does not need authentication or elevated privileges to inject the payload. Once injected, the script runs for all users visiting the impacted page, making this a critical risk for confidentiality and integrity of site users.