Sendpulse Web Push Vulnerabilities

The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a...

CVSS:

7.2

Affected:

up to 1.3.6

Fixed in:

1.3.7

Disclosed:

Oct 16, 2024

CVE-2024-9184 on NVD →

The SendPulse Free Web Push plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the sendpulse_config function. This makes it possible for unauthenticated attackers to change the plugin configuration via a forge...

CVSS:

4.3

Affected:

up to 1.3.1

Fixed in:

1.3.3

Disclosed:

Oct 6, 2023

CVE-2023-45274 on NVD →