CVE-2024-13877: 
WordPress vulnerability analysis and mitigation

The Passbeemedia Web Push Notification WordPress plugin through version 1.0.0 contains a Reflected Cross-Site Scripting (XSS) vulnerability that affects high-privilege users such as administrators. The vulnerability was publicly disclosed on February 26, 2025 (WPScan).

The vulnerability stems from the plugin's failure to properly sanitize and escape a parameter before outputting it back in the page. The vulnerability has been assigned a CVSS v3.1 score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

This vulnerability could be exploited against high-privilege users such as administrators, potentially allowing attackers to execute malicious scripts in the context of the victim's browser session. The successful exploitation could lead to unauthorized access to sensitive information or perform actions with the victim's privileges (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Passbeemedia Web Push Notification WordPress plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).