WPDeveloper NotificationX vulnerabilities

Latest WPDeveloper NotificationX CVEs

Newest publication first

1. CVE-2026-119507 WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.

2. CVE-2022-51021 NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

   Published 2026-10-22

   High·CVSS 8.8

   NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass...

3. CVE-2026-27042 WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability

   Published 2026-02-19

   Medium·CVSS 5.3

   Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.