CVE-2025-15380

High

Published: 20 January 2026

Published

20 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0024 46.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15380 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-15380, published on 2026-01-20, is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress. It affects all versions up to and including 3.2.0 and stems from insufficient input sanitization and output escaping when processing the 'nx-preview' POST parameter. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-79 (Improper Neutralization of Input During Web Page Generation).

Unauthenticated attackers can exploit this vulnerability by creating a malicious webpage that auto-submits a form to the vulnerable WordPress site using a crafted 'nx-preview' POST parameter containing arbitrary web scripts. When a victim user visits the attacker's malicious page, the injected scripts execute in the context of the vulnerable site, potentially leading to session hijacking, phishing, or theft of sensitive data displayed on the page.

Advisories and patch details are available from multiple sources, including the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3433555%40notificationx&old=3426659%40notificationx&sfp_email=&sfph_mail=, CleanTalk research at https://research.cleantalk.org/cve-2025-15380/, and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca12315-380b-4251-b637-4e9d29df35e0?source=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3433

Vulnerability details

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'nx-preview' POST parameter in all versions up to, and including,…

3.2.0. This is due to insufficient input sanitization and output escaping when processing preview data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute when a user visits a malicious page that auto-submits a form to the vulnerable site.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

DOM-based XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and arbitrary JavaScript execution in victim browser context (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1