Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-119303

NotificationX < 3.3.7 - Unauthenticated Settings Update and Email Sending via send-rating REST Route

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Notificationx
CVE-2026-119302

NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Notificationx
CVE-2026-119507

WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpdeveloper
Products
Notificationx Notificationx