TI-2025-17487 CVE-2025-23720 · GHSA-rcmr-jmrm-mjrcWordPress Web Push plugin <= 1.4.0 - CSRF to Stored XSS vulnerabilityPriority LOW 31Cross-Site Request Forgery (CSRF) vulnerability in Marco Castelluccio Web Push web-push allows Stored XSS.This issue affects Web Push: from n/a through <= 1.4.0.CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00193 · Published 2025-01-16 · No fix listed CWE-352