SendPulse Free Web Push

SendPulse Free Web Push has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for SendPulse Free Web Push has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. SendPulse Free Web Push is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all SendPulse Free Web Push vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-9184

SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
SendPulse Free Web Push banner
Latestv1.4.2

SendPulse Free Web Push

SendPulse

Author

SendPulse

5.0(9)
100/100
Last Updated
2026-05-25 (4mo ago)
Active Installs
500+
Downloads
35,683
Requires WP
5.7+
Requires PHP
8.0+
Tested up to
WP 7.0.4
Created
2016-04-08 (11y ago)

SendPulse Web Push is a WordPress plugin that allows you to send web push campaigns. Web push notifications are instant notifications sent to subscribers’ devices. They allow you to quickly inform your customers about recent news, sales, order statuses, or other important events. Your site visitors can sign up to receive notifications about your new posts or important events. FEATURES Browsers supported: Chrome (Desktop & Android), Firefox (Desktop), and Opera (Desktop) on both HTTP and HTTPS sites. Offline notifications: Users will see your notification as soon as they go online. Personalization and segmentation: Your site visitors can receive personalized notifications. Segment your web push campaigns based on users’ location or other details. A/B Testing: Maximize your web push campaigns’ CTR by split-testing them. Trigger messages and bulk messages: Send web push notifications via your personal account, or create automated campaigns triggered by certain events. Real Time Stats: Monitor your open rate, click-through rate, subscription rate, and more. Developer API: Use SendPulse’s API to send web push notifications, emails, and SMS messages via a single platform. Send an unlimited number of web push notifications to 10,000 subscribers for free. With RSS, your subscribers will receive notifications as soon as a new post is published on your WordPress site. Create a SendPulse account to start sending your web push campaigns.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C