Ultimate Push Notifications

Ultimate Push Notifications has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 3 are fixed as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 6.5 out of 10. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 3 issues recorded for Ultimate Push Notifications has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Trương Hữu Phúc (truonghuuphuc). Ultimate Push Notifications is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Ultimate Push Notifications vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2025-31561

Ultimate Push Notifications <= 1.3.0 - Authenticated (Subscriber+) SQL Injection

Read the full analysis

Vulnerability Records

3 records
Ultimate Push Notifications banner
Latestv1.7.0

Ultimate Push Notifications

CodeSolz

Author

CodeSolz

3.0(4)
60/100
Last Updated
2026-10-26 (2d ago)
Active Installs
40+
Downloads
8,632
Requires WP
4.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2020-08-19 (6y ago)

Ultimate Push Notifications is a self-hosted push notification solution for WordPress. It sends notifications from your own server straight to each browser’s push service using the open Web Push standard (VAPID) — on desktop and mobile, even when the visitor is not on your site. No SMS bills. No email list dependency. Just instant, reliable push notifications that actually reach people. Push notifications have 4x higher open rates than email. Keep your customers, community members, and team informed the moment something happens — for free. Why Choose Ultimate Push Notifications? Most push notification services charge a monthly fee per subscriber and keep your subscriber list on their servers. This plugin needs no account with anyone: setup is one button, delivery costs nothing, and every subscription lives in your own database. You own your audience. Real Problems This Plugin Solves For WooCommerce Store Owners: You’re losing sales because customers have no idea their order shipped, their payment failed, or their order is ready. And your vendors have no idea someone just bought from them. This plugin fixes all of that — with instant push alerts for every order event. For BuddyPress / Community Sites: Your community members miss friend requests, new messages, group invites, and activity updates because they’re not watching their inbox. Push notifications bring them back the moment something happens — without email fatigue. For Site Administrators: You need to know the instant a form is submitted, a new user registers, or an event goes live. Real-time push notifications to your browser mean you’re always in the loop, even if your email is buried. For All Sites: Instead of paying for SMS alerts or high-volume email plans, this plugin lets you communicate in real time for free — using the same infrastructure Google uses for Android notifications. Key Features Web Push — Self-Hosted – One-click setup: generate a key pair and you are done. No Firebase project, no Google account – Standards-based delivery (RFC 8030 / 8291 / 8292) straight to each browser’s push service – Background queue with automatic retry and per-service backoff — sends never slow down checkout – Health page checks every link in the chain and says exactly what is wrong when something is – Service Worker handles background notifications even when the browser is closed – Rich notifications: show images inside the push popup – Click-to-navigate: clicking a notification opens the right page automatically – Auto-cleanup: invalid / expired device tokens are removed automatically — no stale bloat – Declarative Web Push for Safari (macOS 15.5+, iOS 18.5+) — notifications still arrive when Apple’s background script does not wake in time – App badge — unread count on the icon of an installed Home Screen app – Notification inbox — the bell opens the latest notifications sent to everyone, with an unread count, so a missed one is still there (also as an [upn_inbox] shortcode) – Chat button — a floating WhatsApp, Telegram, Messenger, call, SMS or email button with office hours, page and device rules, and click counts. Free, and it works even without push – Switching from OneSignal, PushEngage, Webpushr, iZooto, PushAlert, Perfecty, Gravitec or Firebase? Your existing subscribers move over silently on their next visit — no new permission prompt Subscribers — Unlimited, Yours – Visitors subscribe without an account; members subscribe with theirs. No cap, in any tier, ever – Soft-ask prompt: your own dismissible bar or modal asks first — after N seconds, page views or scroll depth — and only hands off to the browser’s one-shot permission prompt when the visitor clicks Allow – Opt-in funnel: prompt shown → Allow → subscribed / blocked, with desktop and mobile subscribe rates – “Why?” on unsubscribe: one tap to say too many, not relevant or just for now — counted, never linked to a person – Floating bell, [upn_subscribe] shortcode, a Push Subscribe Button block, or any element with data-upn-subscribe – Subscriber list shows browser, OS, device, locale, time zone, last seen, last delivery and consent — with Logged-in / Visitors / Web Push views – Privacy tools: subscriptions and preferences are exported and erased with the account (WordPress Privacy → Export / Erase) Compose & Send – Write a notification, pick an audience — everyone, visitors, members, roles, device type, active in the last N days — see the live recipient count, send it to your own device first, then send – Live preview of how it looks on Windows, macOS, Android and iPhone, with warnings before a title gets cut off — and an emoji picker – Push this post from the block or classic editor: send on publish (even where push-on-publish is off), skip it, write a custom title and message, or “Send now” for a published post – UTM tags on your links, so Google Analytics, Matomo or Plausible show push as its own source – Dashboard widget with subscribers, the week’s clicks and click-through, and the opt-in rate – Merge tags — {site_name}, {post_title}, {user_name}, {first_name} and more, plus event tags in automations – Rich payload: icon, large image, click URL; click tracking with click-through rate on the Health page Automations – Push on publish — new posts (or any post type) go to your subscribers automatically, with the featured image – Event automations — trigger → audience → message. Free runs three at a time: – WordPress: new user registers, comment posted, reply to a comment (commenters can tick “Notify me of replies by push” — no account needed) – WooCommerce: new order, order status changes (filter by status), payment received, added to cart, low stock, out of stock – BuddyPress: friend request, friend accepted, private message, member update (to their friends), reply to an update, group update (to the group), member joins a group (to its admins) – Shops, donations, forums, jobs and CRM: Easy Digital Downloads purchases, GiveWP donations, bbPress replies and new topics, WP Job Manager new jobs, FluentCRM tags – Forms: Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Formidable Forms, Ninja Forms and Elementor Pro forms — form submitted, every field a merge tag ({field_your_email}, {field_email}…), whatever the field names – Each automation chooses who: store staff by role, the product’s author (vendor), the customer, the message recipients, the group’s members… The person who caused the event is left out unless you say otherwise – Members turn any automation off for themselves under Set Notifications (and in their BuddyPress profile) Device Management – Every device is tracked individually; one member can register several – Test notifications directly from the admin — verify delivery before going live – Devices a push service reports as gone are removed automatically Ultimate Push Notifications Pro The free plugin sends. Ultimate Push Notifications Pro reaches people push cannot, sends to the right people at the right moment, and tells you what each notification earned. Same unlimited subscribers, a flat licence fee, and still no account with anyone for push. Journeys — a visual builder – Draw a path for each person: a trigger (they subscribe, they buy, a form, a webhook…), then send (push, SMS, WhatsApp, Telegram or email), wait, and “did they click / buy?” with yes and no branches. Each step shows how many people reached it; anyone who buys leaves the journey, counted as converted. Reach them where push cannot – SMS, WhatsApp and Telegram for your customers — they opt in at checkout (“send me updates about this order by SMS”) or in their account, and automations and broadcasts reach them there too, always or only when push cannot. STOP always works. – SMS through your own Android phone with httpSMS — your SIM is the gateway, no per-message SMS provider. WhatsApp through Meta’s Cloud API, Telegram through your own bot. – Two-way inbox — customers’ replies on SMS, WhatsApp and Telegram land in one conversation per number, answered from your dashboard. – Order follow-ups — a review request after delivery, a “pay again” link when a payment fails, a shipping update with the tracking link, cash-on-delivery confirmation by SMS or WhatsApp (“reply YES to confirm”), and wishlist price drops. – Alerts for you and your team — each admin picks the events they want (a sale, a form, low stock…) on their own Telegram, WhatsApp, SMS, email or push; plus carriers to email, Slack and Discord. Send to the right people, at the right time – Segments — saved filters over subscribers and WooCommerce data (bought a category, spent over an amount, lapsed buyers), with seven built-in cohorts – Scheduling — once, daily, weekly or monthly, in each subscriber’s time zone; and best time — each person at the hour they usually click – A/B tests — two versions to slices of the audience; the winner goes to everyone else – Unlimited automations with conditions, and digests (“5 new comments”, not five alerts) – Store automations — abandoned cart and browse reminders, back in stock and price drop alerts, per shopper – Welcome series — a short sequence for every new subscriber – Engagement — win back quiet subscribers, a daily or weekly post digest, a weekly “For you” pick per reader, RSS to push, a thank-you coupon for subscribing, “Remind me” and “Follow this author / category / forum” buttons, segments by country and by what people read, and 35 ready-made automations – On-site messages — banners and pop-ups for the right visitors: a sale for subscribers who never click, an invitation on the third visit – Live notifications — one notification updated in place for an order’s progress, a score or an auction – Delivery rules — quiet hours and frequency caps; a preference centre where subscribers mute categories or pause instead of unsubscribing; editorial approval for contributors’ sends Know what it earned – Revenue attribution — WooCommerce orders credited to the notification that was clicked, net of refunds; Goals for sites that are not stores – Unlimited history, weekly or monthly reports by email or as a print-ready page, and an opt-out risk estimate before you send – Health monitor — the health check every day, with alerts and one-click fixes For agencies and teams – Roles — compose, automations, segments and analytics per role, without making anyone an administrator – White label, export / import between sites, a multisite screen, a REST API and WP-CLI – Integrations — inbound webhooks for Zapier, Make, n8n or your CRM (every JSON field a merge tag), outbound webhooks on subscribe / click / unsubscribe, and Google Analytics 4 events from the server – Ready for AI agents — abilities on the WordPress Abilities API, so Claude, ChatGPT or any MCP client can count an audience, build a segment or send a campaign – AI assistant with your own key (OpenAI, Anthropic, Gemini, Groq, Mistral, Ollama and more) — copy drafts, predicted click-through from your own history with a rewrite for more clicks, translation into each subscriber’s language, 2:1 notification images, plain-language health explanations Every Pro feature is already marked in the free plugin where it would live, with this site’s own numbers where the free plugin knows them — so you can see what it would do before you decide. See everything Pro adds → How It Works Open UPush Notifier → App Config and click Generate key pair. That is the whole setup — no Firebase, no Google account. Turn on the Subscribe Prompt, add the bell or the block — or have members open Register My Device — and visitors allow notifications Their browser is registered — compose a notification, or let an automation send one Notifications are sent from your own server directly to each browser’s push service using the open Web Push standard (VAPID). Nothing is proxied through a third party, no per-subscriber fees, and the subscription data never leaves your database. No app stores. No app to install. Works in Chrome, Firefox, Edge, Safari on macOS, and Safari on iOS 16.4+ once the site is added to the Home Screen. Security The VAPID private key never leaves the database and is never sent to the browser All user inputs are sanitized through WordPress standards AJAX endpoints use nonce verification (SECURE_AUTH_SALT) Capability checks enforce admin-only access to sensitive settings VAPID key authentication ensures only your server can send notifications Requirements WordPress 5.0 or higher PHP 7.4 or higher SSL (HTTPS) required — browsers block push notification registration on non-secure sites OpenSSL PHP extension (present on virtually every host) Nothing else — no third-party account Multi-Device & Testing One user can register multiple browsers / devices For testing: use different browsers or incognito windows logged in as different users Use the Register My Device page to register your own device and test with one click Getting Started (Quick Setup) Install and activate the plugin Go to UPush Notifier → App Config and click Generate key pair Go to UPush Notifier → Register My Device and click Allow when the browser asks Send a test notification — you should receive it within a second or two Open UPush Notifier → Health to confirm every part of the path is working If your server cannot generate keys (the Health page will say so), App Config also accepts a key pair pasted from elsewhere. Upgrading from an earlier version? Devices registered through Firebase will keep their rows but will not receive anything — Google shut down the legacy Firebase API on 22 July 2024. Ask those users to open Register My Device once; their browser re-registers over Web Push automatically. The Health page counts how many are left. Full step-by-step documentation: Getting started with Web Push Video Guides Merge Tag Reference Everywhere – {site_name} {site_url} {date} {time} – {post_title} {post_url} {post_excerpt} {post_type} {author_name} — when the notification is about a post – {user_name} {user_login} {user_email} {first_name} — when it is about a user WooCommerce automations – {order_id} {order_total} {order_status} {status_from} {customer_name} {customer_email} {items_count} {item_names} {payment_method} {order_url} {order_admin_url} – {product_title} {product_price} {product_url} {quantity} {shopper_name} {stock_quantity} {product_admin_url} BuddyPress automations – {initiator_name} {friend_name} {sender_name} {message_subject} {message_excerpt} {thread_url} {member_name} {activity_excerpt} {activity_url} {commenter_name} {comment_excerpt} {group_name} {group_url} {requests_url} {profile_url} Form automations (Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Formidable, Ninja Forms, Elementor) – {form_title} {form_summary} {form_url} and every field as {field_<name>} — e.g. {field_your_email} for a CF7 field named your-email, {field_email} for a field labelled “Email” Comment replies – {comment_author} {comment_excerpt} {parent_excerpt} {comment_url} {post_title} Shops, donations, forums, jobs, CRM – Easy Digital Downloads: {payment_id} {payment_total} {customer_name} {download_names} {payment_url} – GiveWP: {donation_amount} {donor_name} {form_title} {donation_url} – bbPress: {reply_author} {reply_excerpt} {reply_url} {topic_author} {topic_title} {topic_excerpt} {topic_url} {forum_title} – WP Job Manager: {job_title} {company_name} {job_location} {job_url} – FluentCRM: {contact_name} {contact_email} {tag_names} The automation editor lists the tags each trigger provides. Add …

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C