WordPress security by component

SendPulse Free Web Push

Plugin description

SendPulse Free Web Push is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 17, 2024; the highest CVE/CNA score is 7.2.

Plugin slug: sendpulse-web-push

Latest vulnerability

CVE-2024-9184: SendPulse Free Web Push: Cross-site scripting

SendPulse Free Web Push is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PublishedOct 17, 2024

Safe version guidanceSee mitigation notes

		Safe version
Oct 17, 2024	CVE-2024-9184 SendPulse Free Web Push: Cross-site scripting SendPulse Free Web Push is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVDPending
Oct 16, 2023	CVE-2023-45274 Sendpulse Web Push: Cross-site request forgery Sendpulse Web Push is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8