Cross‑Site Request Forgery in the All push notification for WP plugin allows an attacker to generate a reflected XSS payload. The flaw can execute arbitrary JavaScript in the context of a victim’s browser, potentially stealing session cookies, defacing the site, or conducting further attacks on behalf of the victim. The weakness is a classic reflected XSS driven by an unauthenticated CSRF vector, as identified by CWE‑352.

The vulnerability affects the WordPress All push notification for WP plugin from the earliest release through version 1.5.3. Sites running this plugin version are therefore exposed.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score of less than 1 % suggests a low probability of real‑world exploitation at this time, and the issue is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker sending a crafted link or form to a legitimate user, and when the user processes the request, the reflected script executes. Because the flaw is triggered by the plugin’s CSRF mechanism, privileged users of the site who interact with the plugin’s interface are the most likely target.