EUVD-2026-47936
GHSA-9vh2-928p-mm63
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor account required (PR:L); stored XSS fires only when victim visits page (UI:R); script executes in victim browser changing scope (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notification_body' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the save_send_notification_flag() function and missing output escaping in the wpp_notification_box() function, which concatenates raw post meta values directly into HTML attribute and textarea contexts. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Webpushr Push Notifications WordPress plugin (versions ≤4.39.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the notification title and body parameters. The injected payload persists in post meta storage and executes in any victim's browser - including administrators - upon visiting an affected page, enabling session hijacking, credential theft, or privilege escalation to admin-level access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
The affected product is the Webpushr Push Notifications plugin for WordPress (CPE: cpe:2.3:a:webpushr:web_push_notifications_-_webpushr:*:*:*:*:*:*:*:*), a web push subscription and notification delivery tool. CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests through a two-stage failure in webpushr_functions.php: the write path - save_send_notification_flag() (lines 513 and 517) - accepts the webpushr_notification_title and webpushr_notification_body POST parameters and stores them as raw post meta without sanitization; the read path - wpp_notification_box() (lines 699 and 702) - retrieves those stored values and concatenates them directly into HTML attribute and textarea contexts without output escaping. This is the classic stored XSS dual-failure pattern: no sanitization on input, no escaping on output, in two distinct rendering contexts.
RemediationAI
Update the Webpushr Push Notifications plugin to the latest available version via the WordPress admin dashboard or via WP-CLI (wp plugin update webpushr-web-push-notifications), confirming the installed version exceeds 4.39.0. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/39286096-2efa-450b-b491-b3d40de5a4ae?source=cve for confirmed fix-version details, as no explicit patched version was identified in the available data. As an interim compensating control, revoke contributor-level and above access for any untrusted or external users; this eliminates the attacker's required privilege entirely. Additionally, audit existing post meta for the keys webpushr_notification_title and webpushr_notification_body across all posts for signs of injected payloads - discard any containing script tags or event handler attributes. A WordPress WAF rule blocking script injection patterns in those parameters provides partial defense but should not replace patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today