All push notification for WP

All push notification for WP has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; none of them are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection.

None of the 4 issues recorded for All push notification for WP have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, one record each.

01234567891003.02.2025Today03.02.20257.2All push notification for WP <= 1.5.3 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 03.02.202509.04.20254.3All push notification for WP <= 1.5.3 - Cross-Site Request Forgery to SQL Injection CVSS 4.3 · 09.04.202514.04.20256.1All push notification for WP <= 1.5.3 - Reflected Cross-Site Scripting CVSS 6.1 · 14.04.202503.02.20264.9All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter CVSS 4.9 · 03.02.2026

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage0%
Open

4

Fixed

0

Get automatic notifications for all All push notification for WP vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2025-25092

All push notification for WP <= 1.5.3 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C