Vulnerabilities

TI-2026-86504 CVE-2026-119490 · GHSA-25wx-2cq4-9r54

Cross-site scripting in Better Notifications for WP WordPress plugin

LOW 24

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00236 Published 2026-11-07 No fix listed CWE-80

TI-2023-16152 CVE-2023-32964 · GHSA-x22f-54f8-8rxx

WordPress Better Notifications for WP Plugin <= 1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-05-26 No fix listed CWE-352

TI-2022-00271 CVE-2022-0345 · GHSA-9jh8-cc8h-44v2

Better Notifications for WP < 1.8.7 - Email Address Disclosure

LOW 20

The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-ma…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00429 Published 2022-02-28 Fixed in 1.8.7 CWE-352

Vulnerabilities

Filters

Cross-site scripting in Better Notifications for WP WordPress plugin

WordPress Better Notifications for WP Plugin <= 1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)

Better Notifications for WP < 1.8.7 - Email Address Disclosure