Description
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Push Notifications for WordPress by PushAssist | ≤ 3.0.8 | — |
References
- https://wpscan.com/vulnerability/08f5089c-36f3-4d12-bca5-99cd3ae78f67 exploit vdb-entry technical-description