Vulnerabilities
Summary — last 7 days
New vulnerabilities4,602▼ 773 vs. last week
Critical / high1,808▼ 1,296 vs. last week
New active exploitation (KEV)8▲ 1 vs. last week
Unscored (no CVSS)745▲ 647 vs. last week
More filters
11 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.8) | 0.36% | — | Adwised WEB Push NotificationAI | 10/11/2026 | 10/13/2026 | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that… | |
| Deferred | High (8) | 0.28% | — | Adwised WEB Push NotificationAI | 10/11/2026 | 10/13/2026 | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page,… | |
| Deferred | Medium (5.3) | 0.34% | — | Webpushr-web-push-notificationsAI | 1/23/2026 | 6/17/2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0. | |
| Deferred | Medium (4.3) | 0.24% | — | Gravitec.net WEB Push NotificationsAI | 12/9/2025 | 10/7/2026 | Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17. | |
| Deferred | Medium (5.9) | 0.18% | — | Pusheco Pushe WEB Push NotificationAI | 9/5/2025 | 10/5/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows Stored XSS.This issue affects Pushe Web Push Notification: from n/a through <= 0.5.0. | |
| Analyzed | High (7.1) | 0.28% | — | Feedify WEB Push Notifications | 4/10/2025 | 6/17/2026 | The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |
| Analyzed | High (7.1) | 0.28% | — | Sjehutch Passbeemedia WEB Push Notification | 3/20/2025 | 6/17/2026 | The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |
| Modified | Medium (5.4) | 0.43% | — | Webpushr WEB Push Notifications | 11/27/2023 | 6/17/2026 | The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks. | |
| Modified | High (8.8) | 0.32% | — | Webpushr WEB Push Notifications | 11/13/2023 | 6/17/2026 | Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications – Webpushr plugin <= 4.34.0 versions. | |
| Modified | Medium (6.1) | 0.90% | — | Feedify WEB Push Notifications | 9/10/2021 | 6/17/2026 | The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8. | |
| Modified | Medium (5.4) | 1.1% | — | Onesignal-free-web-push-notifications | 8/30/2019 | 6/17/2026 | The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. |