Executive brief
The Webpushr plugin for WordPress, which allows websites to send push notifications to visitors, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into the site. These scripts can run automatically when other users, including administrators, view specific pages within the WordPress dashboard. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the save_send_notification_flag() function and a lack of output escaping in the wpp_notification_box() function. Specifically, the plugin concatenates raw post meta values from the 'webpushr_notification_title' and 'webpushr_notification_body' parameters directly into HTML attribute and textarea contexts. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary web scripts. These scripts are stored on the server and execute in the browser of any user who accesses the affected administrative pages. The vulnerability exists in all versions up to and including 4.39.0.
Affected products
- Webpushr Web Push Notifications – Webpushr <= 4.39.0
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory
References
- https://plugins.trac.wordpress.org/browser/webpushr-web-push-notifications/trunk/include/webpushr_functions.php
- https://plugins.trac.wordpress.org/browser/webpushr-web-push-notifications/trunk/include/webpushr_functions.php
- https://plugins.trac.wordpress.org/browser/webpushr-web-push-notifications/trunk/include/webpushr_functions.php
- https://plugins.trac.wordpress.org/browser/webpushr-web-push-notifications/trunk/include/webpushr_functions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/39286096-2efa-450b-b491-b3d40de5a4ae?source=cve