CVE-2026-9729

Name of the Vulnerable Software and Affected Versions Webpushr Push Notifications versions prior to 4.39.1

Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. This is caused by insufficient input sanitization in the save send notification flag() function and missing output escaping in the wpp notification box() function, which directly concatenates raw post meta values into HTML attribute and textarea contexts. The issue involves the webpushr notification title and webpushr notification body parameters.

Recommendations Update to a version newer than 4.39.0. As a temporary workaround, restrict access to the webpushr notification title and webpushr notification body parameters for users with contributor-level access.