Live › vulnerability › CVE-2026-110721
Go to dashboardNotificationX up to and including 3.3.3 registers the REST route /notificationx/v1/popup-submit with no permission check, so anyone can call it. An attacker can use it to add forged names, titles, messages and emails to any enabled non-popup campaign, such as WP Comments or WooCommerce sales.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites that run NotificationX or older are exposed, because the route accepts requests from anonymous visitors. The impact is most visible on sites with enabled WP Comments, WooCommerce, EDD, Give or review campaigns; sites that only use popup or exit-intent campaigns are not exposed to the injection. Sites without the plugin can skip it.
3.3.3No product ranges from the sources yet.
wp plugin get notificationx --field=version or the Plugins screen; versions 3.3.3 and older are affected./wp-json/notificationx/v1/popup-submit without logging in and see whether the route responds.3.3.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
This page as .md · .json · in your agent: get_signal("CVE-2026-110721")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.