NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109513 · Microsoft / collected KEV context

cve-program · CVE-2026-109513

• https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=cve
• https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/blocks/Blocks.php#L218
• https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Features/ShortcodeInline.php#L148
• https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/WordPress/WPOrgReview.php#L295
• https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L55
• https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1119
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3746251%40notificationx%2Ftags%2F3.3.4&old=3720837%40notificationx%2Ftags%2F3.3.3

No related operational record is retained in the current change model.