CVE-2026-78563

NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 395 live websites that are affected by CVE-2026-78563.

Run a Free Instant Scan



Affected Software

Product  Notificationx
Category Wordpress Plugins
Vulnerable Domains395 live websites (31% of Notificationx install base)
Vulnerable Versions
  • from 0 through 3.1.4
Vulnerable Versions Count53 versions ( 75% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 25, 2026
  • Updated - Aug 25, 2026

Credits

  • Nguyen Ba Khanh (finder)

Website Distribution by Country

Number of websites using CVE-2026-78563
United States112 websites


Germany26 websites
GB25 websites
Malaysia22 websites
Russia17 websites
Poland17 websites
France13 websites
India12 websites
Vietnam11 websites
Spain8 websites

Website Distribution by TLD

Number of websites using CVE-2026-78563
.com201 websites
.ru14 websites
.pl13 websites
.co.uk13 websites
.org11 websites
.net9 websites
.de7 websites
.nl5 websites
.es4 websites
.com.br3 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-78563

Top websites that are affected by CVE-2026-78563. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.com United States**,***
**************.ru Russia***,***
*************.com United States***,***
*******.com GB***,***
********.***.br Brazil***,***
********.com United States***,***
****.by Belarus***,***
**********.com Germany***,***
*******.sk Slovakia***,***
******************.com United States***,***
See full domain list

FAQ

CVE-2026-78563 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Notificationx
A total of 395 websites have been identified as vulnerable to CVE-2026-78563, based on global website indexing conducted by WebTechSurvey.
The Notificationx is affected by the CVE-2026-78563 vulnerability.
Notificationx versions up to and including 3.1.4 are vulnerable to CVE-2026-78563.