High · 7.1 CVE-2025-32540 EUVD-2025-11672GHSA-3f43-pmrc-xpp4

WordPress Feedify – Web Push Notifications plugin <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

Published Apr 17, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: feedify Product: Feedify – Web Push Notifications

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications push-notification-by-feedify allows Reflected XSS.This issue affects Feedify – Web Push Notifications: from n/a through <= 2.4.5.

Affected products

Vendor	Product	Affected	Fixed
feedify	Feedify – Web Push Notifications	≤ 2.4.5	—

References

https://patchstack.com/database/Wordpress/Plugin/push-notification-by-feedify/vulnerability/wordpress-feedify-web-push-notifications-plugin-2-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry