Skip to content
Sign in
4.3 Medium

CVE-2026-0554 The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…

Description

The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and including, 3.1.11. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset analytics for any NotificationX campaign, regardless of ownership.

Affected products and versions

Product Affected versions Fixed in
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar 3.1 earliest → 3.1.11 No fix stated

Other CVEs of NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

The 7 CVEs of NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar →
CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner &… 7.2 High CVE-2026-110721 The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection… 5.3 Medium CVE-2025-15380 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner &… 7.2 High CVE-2024-11727 The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating… 4.4 Medium
Track this CVE