PT-2026-3573 · Unknown+1 · Woocommerce+1

Dmitry Ignatyev · Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-15380

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress versions through 3.2.0

Description The NotificationX plugin for WordPress is susceptible to a DOM-Based Cross-Site Scripting issue. This occurs because of inadequate input sanitization and output escaping when handling preview data. An unauthenticated attacker can inject arbitrary web scripts into pages by exploiting the nx-preview POST parameter. This allows for script execution when a user visits a malicious page that automatically submits a form to the vulnerable site.

Recommendations Update the NotificationX plugin to a version newer than 3.2.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15380

Affected Products

Notificationx

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-15380 · Security Note
• https://twitter.com/CVEnew/status/2013625622149636304 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3433555%40notificationx&old=3426659%40notificationx&sfp_email=&sfph_mail= · Note
• https://research.cleantalk.org/cve-2025-15380 · Note
• https://t.me/CVEtracker/42631 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9ca12315-380b-4251-b637-4e9d29df35e0?source=cve · Note