Vulnerabilities and security researches forpush-notification-by-feedify push-notification-by-feedify

Apr 19, 2025

CVE, Research URL: CVE-2025-32540
Home page URL: Security reports for Feedify – Web Push Notifications
Application: Feedify – Web Push Notifications
Date: Apr 17, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications allows Reflected XSS. This issue affects Feedify – Web Push Notifications: from n/a through 2.4.5.
Affected versions: Min -, max -.
Status: vulnerable

Apr 12, 2025

CVE, Research URL: CVE-2024-13874
Home page URL: Security reports for Feedify – Web Push Notifications
Application: Feedify – Web Push Notifications
Date: Apr 10, 2025
Research Description: The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected versions: Min -, max -.
Status: vulnerable

Dec 21, 2024

CVE, Research URL: CVE-2024-11811
Home page URL: Security reports for Feedify – Web Push Notifications
Application: Feedify – Web Push Notifications
Date: Dec 21, 2024
Research Description: The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'platform', 'phone', 'email', and 'store_url' parameters. in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: Min -, max -.
Status: vulnerable

Jun 06, 2024

CVE, Research URL: CVE-2021-38352
Home page URL: Security reports for Feedify – Web Push Notifications
Application: Feedify – Web Push Notifications
Date: Sep 10, 2021
Research Description: The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8.
Affected versions: Min -, max -.
Status: vulnerable