CVE-2026-119507 · Package
NO FIX YET · SEE WHAT TO DO
NotificationX, a WordPress notification plugin by WPDeveloper, fails to neutralize script-related HTML tags on a web page, which is a cross-site scripting flaw. An attacker can inject code that runs in a visitor's browser.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the NotificationX WordPress plugin at version 3.3.6 or earlier are in scope, according to the NVD description. The sources do not describe which page or input is involved, so unknown whether a default install is exposed.
Not affected if plugin-not-installed
Who cares notificationx, self-hosted, wordpress
wp plugin get notificationx --field=version3.3.6 are affected; move to a later release than 3.3.63.3.6 not stated in the sourcesImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.