PLUGIN SECURITY
Is Notificationx safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Notificationx WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
notificationx - Requires PHP: 5.6+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 2.3.9 [CVE-2022-0349, WordPress NotificationX plugin <= 2.3.8 - Unauthenticated Blind SQL Injection (SQLi) vulnerability, NotificationX <= 2.3.8 - Blind SQL Injection, NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 2.3.12 [WordPress NotificationX plugin <= 2.3.11 - Unauthenticated SQL Injection (SQLi) vulnerability]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3 [WordPress NotificationX plugin <= 1.8.2 - Cross-Site Request Forgery (CSRF) vulnerability]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3 [Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 2.3.12 [NotificationX <= 2.3.11 - SQL Injection]
+ 10 more known vulnerabilities
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3 [Various Affected Software (Various Versions) - Cross-Site Request Forgery Bypass]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3 [CVE-2021-4342]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 1.8.3 [CVE-2020-36744, NotificationX <= 1.8.2 - Cross-Site Request Forgery Bypass, NotificationX < 1.8.3 - Cross-Site Request Forgery]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 2.3.12 [NotificationX < 2.3.12 - Unauthenticated SQLi]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 2.8.3 [CVE-2024-1698, NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection, WordPress NotificationX Plugin <= 2.8.2 is vulnerable to SQL Injection, NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor < 2.8.3 - Unauthenticated SQL Injection]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 2.9.4 [CVE-2024-11727, NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting, WordPress NotificationX Plugin <= 2.9.3 is vulnerable to Cross Site Scripting (XSS)]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.0.0 [CVE-2025-22683, NotificationX <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting, EUVD-2025-2911]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.2.1 [CVE-2025-15380, NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview']
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.2.2 [CVE-2026-27042, NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.2.1 - Missing Authorization]
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.2.1 [CVE-2026-0554, NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) — 100000+ active installs — max PHP 8.4
- WPFront Notification Bar — 50000+ active installs — max PHP 8.4
- FOMO & Social Proof Notifications by TrustPulse – Best WordPress FOMO Plugin — 10000+ active installs — max PHP 8.4
- Top Bar — 10000+ active installs — max PHP 8.4
- WP Notification Bars — 10000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.