Cross-Site Request Forgery Vulnerability in All Push Notification for WP by gtlwpdev
CVE-2025-32546

7.1HIGH

Key Information:

Vendor

WordPress
Status
All Push Notification For WP
Vendor
CVE Published:
17 April 2025

What is CVE-2025-32546?

A Cross-Site Request Forgery (CSRF) vulnerability in the All Push Notification for WP plugin by gtlwpdev allows attackers to exploit authenticated user sessions, leading to reflected Cross-Site Scripting (XSS). This flaw exposes users to various attacks, enabling unauthorized actions by tricking users into submitting requests without their consent. The vulnerability affects all versions of the plugin up to 1.5.3, highlighting the need for immediate updates to protect against potential exploitation.

Affected Version(s)

All push notification for WP <= 1.5.3

References

https://patchstack.com/database/wordpress/plugin/all-push...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xd4rk5id3 (Patchstack Alliance)
.