Description

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notification_body' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the save_send_notification_flag() function and missing output escaping in the wpp_notification_box() function, which concatenates raw post meta values directly into HTML attribute and textarea contexts. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-07-23T08:16:25.540Z",
  "pubdate": "2026-07-23T08:16:25.540Z",
  "executiveSummary": "The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and missing output escaping.\nThe vulnerability affects versions up to, and including, 4.39.0 of the Webpushr Push Notifications plugin.\nAuthenticated attackers with contributor-level access and above can exploit this flaw to inject arbitrary web scripts into pages.\nInjected scripts execute within the context of a victim's browser session whenever a user accesses an injected page.\nSuccessful exploitation can lead to unauthorized actions, session hijacking, or defacement within the WordPress administrative environment.\nThe attack vector requires authenticated access with specific privilege requirements, limiting unauthenticated exploitation.",
  "technicalDetails": "The root cause of the vulnerability stems from two primary coding deficiencies: insufficient input sanitization within the save_send_notification_flag() function and missing output escaping within the wpp_notification_box() function.\nThe vulnerable component handles post meta values associated with the 'webpushr_notification_title' and 'webpushr_notification_body' parameters.\nDuring the data handling process, the wpp_notification_box() function concatenates raw post meta values directly into HTML attribute and textarea contexts without applying adequate context-aware output escaping.\nAttackers possessing contributor-level privileges or higher can supply malicious payloads targeting the 'webpushr_notification_title' and 'webpushr_notification_body' parameters.\nThe attack flow proceeds as follows: 1) An authenticated attacker with appropriate privileges crafts a malicious request containing arbitrary web script payloads in the targeted parameters. 2) The input is processed by the save_send_notification_flag() function with insufficient sanitization and stored persistently in the database as post meta. 3) When an administrative user or authorized individual accesses the affected page, the wpp_notification_box() function retrieves the raw post meta values and injects them directly into HTML attribute and textarea contexts. 4) The victim's browser renders the response, executing the arbitrary script in the context of the user's session.\nPost-exploitation impact includes the execution of arbitrary JavaScript, potentially enabling session hijacking, administrative action spoofing, or further compromise of the WordPress site depending on the privileges of the victim viewing the injected page."
}