CVE-2025-32540: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Feedify – Web Push Notifications WordPress plugin, affecting versions up to 2.4.5. The vulnerability was identified with CVE identifier CVE-2025-32540 and was publicly disclosed on April 15, 2025. The vulnerability was discovered by security researcher João Pedro S Alcântara (Kinorth) and was initially reported on November 30, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. According to the CVSS 3.1 scoring system, it received a severity score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability can be exploited by unauthenticated users, indicating a significant security risk (NVD, Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into affected websites. These injected scripts would be executed when visitors access the compromised sites (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires no authentication to exploit, making it particularly concerning. Hackers typically automate attacks against such vulnerabilities to compromise as many websites as possible before users can apply patches (Patchstack).

The vulnerability has been fixed in version 2.4.6 of the Feedify – Web Push Notifications plugin. Users are advised to update to version 2.4.6 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).