WordPress All Push Notification Plugin Cross-Site Request Forgery Vulnerability Allowing Reflected Cross-Site Scripting

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress All Push Notification plugin, specifically in versions through 1.5.3. This vulnerability allows for Reflected Cross-Site Scripting (XSS) attacks.

Impact

Exploitation of this vulnerability could enable attackers to perform actions on behalf of users with higher privileges, potentially leading to unauthorized changes or data exposure.

Remediation

Users of the WordPress All Push Notification plugin are advised to remove and replace the software, as it is likely abandoned and will not receive further updates or fixes. Patchstack has issued a virtual patch to mitigate this vulnerability until an official fix is available.