CVE-2025-58873 - WordPress Pushe Web Push Notification Plugin <= 0.5.0 - Cross Site Scripting (XSS) Vulnerability

Back Back to CVE browser

MEDIUM

WordPress Pushe Web Push Notification Plugin <= 0.5.0 - Cross Site Scripting (XSS) Vulnerability

Published Sep 5, 2025

5.9

MEDIUM

CVSS 3.1

EPSS 0.18%

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows Stored XSS.This issue affects Pushe Web Push Notification: from n/a through <= 0.5.0.

Affected products

Vendor Pusheco Product Pushe Web Push Notification Default
unaffected
Affected
- ≥ 0, ≤ 0.5.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Pusheco	Pushe Web Push Notification	unaffected	Affected ≥ 0, ≤ 0.5.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26904		Advisory
https://patchstack.com/database/Wordpress/Plugin/pushe-webpush/vulnerability/wordpress-pushe-web-push-notification-plugin-0-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve		vdb-entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Patchstack

Published Sep 5, 2025

Updated May 12, 2026

Reserved Sep 5, 2025

Link CVE-2025-58873

CISA Vulnrichment

Updated Sep 5, 2025

NVD

Status Deferred

Modified Oct 5, 2026

Link CVE-2025-58873

Red Hat

No data

ENISA EUVD

Assigner Patchstack

Published Sep 5, 2025

Updated May 12, 2026

Link EUVD-2025-26904

GitHub

No data