{"id":"CVE-2026-119507","kind":"vulnerability","aliases":["CVE-2026-119507"],"related":[],"title":"NotificationX WordPress plugin: basic XSS lets script injection through web pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.","summary":"NotificationX, a WordPress notification plugin by WPDeveloper, fails to neutralize script-related HTML tags on a web page, which is a cross-site scripting flaw. An attacker can inject code that runs in a visitor's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["notificationx","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed NotificationX version in the WordPress plugins screen or `wp plugin get notificationx --field=version`\n- Confirm whether the plugin is active on the site","fix":"- NotificationX versions through `3.3.6` are affected; move to a later release than `3.3.6`\n- Fixed version beyond `3.3.6` not stated in the sources","status":"open","published_at":"2026-11-07T10:17:09+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:46+00:00","updated_at":"2026-11-07T10:48:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T10:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- NotificationX versions through `3.3.6` are affected; move to a later release than `3.3.6`\n- Fixed version beyond `3.3.6` not stated in the sources","reach":"internet","title":"NotificationX WordPress plugin: basic XSS lets script injection through web pages","impact":"medium","summary":"NotificationX, a WordPress notification plugin by WPDeveloper, fails to neutralize script-related HTML tags on a web page, which is a cross-site scripting flaw. An attacker can inject code that runs in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","notificationx","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers on the affected site","analyst_note":"Check the WPDeveloper advisory or the WordPress plugin changelog for the fixed version and the vulnerable input, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119507.","how_to_check":"- Check the installed NotificationX version in the WordPress plugins screen or `wp plugin get notificationx --field=version`\n- Confirm whether the plugin is active on the site\n- unknown whether the sources name a specific trigger path","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the NotificationX WordPress plugin at version 3.3.6 or earlier are in scope, according to the NVD description. The sources do not describe which page or input is involved, so unknown whether a default install is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4223,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119507':14A,17A '-2026':13A,16A '3.3.6':91C 'affect':86C 'allow':82C 'attack':52B 'basic':4A,75C 'browser':62B 'code':55B,83C 'cross':47B 'cross-sit':46B 'cve':12A,15A 'fail':31B 'flaw':50B 'host':22B 'html':37B,69C 'improp':63C 'inject':8A,54B 'injection.this':84C 'issu':85C 'let':6A 'n/a':89C 'neutral':33B,64C 'notif':27B 'notificationx':1A,18B,24B,80C,81C,87C 'packag':19B 'page':11A,42B,74C 'plugin':3A,28B 'relat':36B,68C 'run':57B 'script':7A,35B,49B,67C 'script-rel':34B,66C 'self':21B 'self-host':20B 'site':48B 'tag':38B,70C 'visitor':60B 'vulner':77C 'web':10A,41B,73C 'wordpress':2A,23B,26B 'wpdevelop':30B,79C 'xss':5A,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the NotificationX WordPress plugin at version 3.3.6 or earlier are in scope, according to the NVD description. The sources do not describe which page or input is involved, so unknown whether a default install is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","notificationx","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119507':14A,17A '-2026':13A,16A 'basic':4A 'cve':12A,15A 'inject':8A 'let':6A 'notificationx':1A 'page':11A 'plugin':3A 'script':7A 'web':10A 'wordpress':2A 'xss':5A","search_b":"'attack':52B 'browser':62B 'code':55B 'cross':47B 'cross-sit':46B 'fail':31B 'flaw':50B 'host':22B 'html':37B 'inject':54B 'neutral':33B 'notif':27B 'notificationx':18B,24B 'packag':19B 'page':42B 'plugin':28B 'relat':36B 'run':57B 'script':35B,49B 'script-rel':34B 'self':21B 'self-host':20B 'site':48B 'tag':38B 'visitor':60B 'web':41B 'wordpress':23B,26B 'wpdevelop':30B","search_c":"'3.3.6':91C 'affect':86C 'allow':82C 'basic':75C 'code':83C 'html':69C 'improp':63C 'injection.this':84C 'issu':85C 'n/a':89C 'neutral':64C 'notificationx':80C,81C,87C 'page':74C 'relat':68C 'script':67C 'script-rel':66C 'tag':70C 'vulner':77C 'web':73C 'wpdevelop':79C 'xss':76C","first_public_at":"2026-11-07T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119507","severity":null,"published_at":"2026-11-07T10:17:09+00:00","modified_at":"2026-11-07T10:17:09+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}