CVE Database /
CVE-2020-36744
CVE · Medium
CVE-2020-36744 — NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2020-36744
|
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3 |
Cross-Site Request Forgery (CSRF) |
Medium
4.3
|
< 1.8.3
|
1.8.3 |
2020-09-16 |
—
|
CVE-2020-36744
The NotificationX plugin before version 1.8.3 contains a cross-site request forgery vulnerability in the generate_conversions() function due to insufficient nonce verification. An attacker could exploit this flaw by tricking a site administrator into clicking a malicious link, allowing the attacker to generate fraudulent conversions without proper authorization. This vulnerability affects unauthenticated users and could be used to manipulate conversion data on vulnerable installations.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings