The Webpushr Push Notifications plugin for WordPress contains a stored cross‑site scripting vulnerability (CWE‑79). The flaw originates from insufficient input sanitization of the 'webpushr_notification_title' and 'webpushr_notification_body' parameters within the save_send_notification_flag() function and from missing output escaping in the wpp_notification_box() function. As a result, an authenticated user with contributor or higher privileges can insert arbitrary JavaScript into these fields, which is then rendered unescaped in the notification box on other users’ pages. The injected script will execute for any visitor who accesses a page where the notification box is rendered.

The vulnerability affects the Web Push Notifications – Webpushr plugin from the Webpushr vendor, specifically all WordPress installations running plugin version 4.39.0 or earlier. No additional fragmentation of product names is required; the plugin is the sole affected component in a typical WordPress site.

The CVSS base score is 6.4, indicating a medium severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to authenticate to the WordPress backend with at least contributor‑level access and then inject malicious payloads into the notification title or body fields. The injected script will execute for any visitor who accesses a page where the notification box is rendered, enabling widespread impact within the affected site.