CVE-2023-5620: Webpushr < 4.35.0 - Unauthenticated Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-27 · updated 2026-06-17
Weakness: CWE-79

Description

The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.

Affected products

Web Push Notifications: before 4.35.0 — fixed in 4.35.0

How to fix

Upgrade to a fixed version: Web Push Notifications 4.35.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a03330c2-3ae0-404d-a114-33b18cc47666
https://wpscan.com/vulnerability/a03330c2-3ae0-404d-a114-33b18cc47666

Get alerted when CVE-2023-5620 or the next vulnerability affects your stack