CVE-2024-12407: 
WordPress vulnerability analysis and mitigation

The Push Notification for Post and BuddyPress plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-12407) discovered on January 11, 2025. The vulnerability affects all versions up to and including 2.06 and is caused by insufficient input sanitization and output escaping of the 'pushnotificationid' parameter (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The flaw exists due to improper neutralization of input during web page generation, specifically in the handling of the 'pushnotificationid' parameter (NVD).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. This could lead to the compromise of user data and potential session hijacking (NVD).

Users should update to a version newer than 2.06 if available. Until an update is applied, website administrators should consider implementing additional security controls such as Web Application Firewalls (WAF) to filter potentially malicious inputs (NVD).