Description
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
Published: 2026-08-25
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update NotificationX Pro to version 3.1.5 or later, ensuring the fix for stored XSS is included.
  • Verify that the plugin is properly deactivated on user accounts that should not have editing rights and remove any deprecated instances of the plugin from the site.
  • Configure the WordPress site to use strong Content‑Security‑Policy headers that block inline scripts and restrict script sources, mitigating the impact of any remaining XSS payloads.

Generated by OpenCVE AI on August 25, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Tue, 01 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Title NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

Tue, 25 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Description The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: REJECTED

Assigner: Wordfence

Published:

Updated: 2026-09-01T13:20:32.146Z

Reserved: 2026-08-24T20:08:43.124Z

Link: CVE-2026-78563

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-25T09:17:36.247

Modified: 2026-09-01T14:17:41.467

Link: CVE-2026-78563

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T09:30:05Z

Weaknesses

No weakness.