CVE-2026-9729: Webpushr Push Notifications XSS Flaw

CVE-2026-9729 Overview

CVE-2026-9729 is a Stored Cross-Site Scripting (XSS) vulnerability in the Webpushr Push Notifications plugin for WordPress. The flaw affects all versions up to and including 4.39.0. It stems from insufficient input sanitization in the save_send_notification_flag() function and missing output escaping in the wpp_notification_box() function. The plugin concatenates raw post meta values directly into HTML attribute and textarea contexts. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript through the webpushr_notification_title and webpushr_notification_body parameters. Injected scripts execute in the browser of any user who accesses an affected page.

Critical Impact
Authenticated contributors can persistently inject JavaScript that executes in the sessions of administrators and site visitors, enabling account takeover and content manipulation.

Affected Products

Webpushr Push Notifications plugin for WordPress (versions up to and including 4.39.0)
WordPress sites allowing contributor-level user registration
Any WordPress instance running the vulnerable webpushr-web-push-notifications package

Discovery Timeline

2026-07-23 - CVE-2026-9729 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9729

Vulnerability Analysis

The vulnerability is a classic Stored Cross-Site Scripting flaw classified under [CWE-79]. The Webpushr plugin exposes two post meta fields, webpushr_notification_title and webpushr_notification_body, which are populated when a user with edit_posts capability saves a post. The save_send_notification_flag() function persists these values without applying WordPress sanitization helpers such as sanitize_text_field() or wp_kses(). When the post editor is rendered again, the wpp_notification_box() function reads the raw meta values and concatenates them into an HTML value attribute and a <textarea> element without calling esc_attr() or esc_textarea().

Because the payload is stored in the WordPress database, execution persists across sessions and users. An administrator reviewing the affected post triggers the injected script under a privileged origin.

Root Cause

The root cause is a missing sanitize-on-input and escape-on-output pattern. The plugin trusts contributor-supplied input for two meta fields and injects those values into two distinct HTML contexts (attribute and textarea) without context-appropriate escaping. Both storage and render paths are affected.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker submits a post containing a crafted payload in either the notification title or body field. The payload is written to post meta by save_send_notification_flag(). When any user with access to that post's editor loads the page, wpp_notification_box() renders the unescaped payload and the browser executes the attacker's script under the WordPress origin.

Refer to the vulnerable source lines documented at WordPress Webpushr Code Snippet L513, L517, L699, and L702. No verified proof-of-concept code has been published; the vulnerability mechanism is described in prose based on the vendor advisory and source references.

Detection Methods for CVE-2026-9729

Indicators of Compromise

Post meta rows for keys webpushr_notification_title or webpushr_notification_body containing <script>, onerror=, onload=, javascript:, or HTML tags
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains after visiting the post editor
Newly created administrator accounts or modified user roles following contributor activity
WordPress audit log entries showing contributor edits immediately followed by admin-session anomalies

Detection Strategies

Query the wp_postmeta table for values matching XSS payload patterns in the two vulnerable meta keys
Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts in the wp-admin editor
Deploy a Web Application Firewall (WAF) rule to inspect POST requests to post.php and post-new.php for script tags in Webpushr parameters
Compare installed plugin version against the fixed release using WP-CLI: wp plugin get webpushr-web-push-notifications --field=version

Monitoring Recommendations

Log all contributor and author account activity, including post saves and meta updates
Alert on wp-admin sessions that spawn outbound requests to non-WordPress domains
Review the Wordfence Vulnerability Report for updated indicators
Monitor for creation of new privileged users or changes to existing user roles

How to Mitigate CVE-2026-9729

Immediate Actions Required

Update the Webpushr Push Notifications plugin to a version later than 4.39.0 once a patched release is available
Audit all existing posts and post meta for injected payloads in webpushr_notification_title and webpushr_notification_body
Restrict contributor and author account creation, and review existing low-privilege accounts for legitimacy
Rotate administrator credentials and invalidate active sessions if injection is confirmed

Patch Information

The Wordfence advisory identifies all versions up to and including 4.39.0 as vulnerable. Site owners should monitor the plugin's WordPress.org repository and apply the vendor-supplied fix as soon as it is published. Until a patch is applied, treat the plugin as an active attack surface for any user account with post-editing capability.

Workarounds

Deactivate the Webpushr Push Notifications plugin until a patched version is installed
Remove contributor and author privileges from untrusted accounts, or disable open user registration
Deploy a WAF rule that blocks HTML and script metacharacters in Webpushr POST parameters
Add a strict Content Security Policy to wp-admin that disallows inline script execution

bash

# Configuration example: identify and disable the vulnerable plugin via WP-CLI
wp plugin get webpushr-web-push-notifications --field=version
wp plugin deactivate webpushr-web-push-notifications

# Search post meta for potential stored payloads
wp db query "SELECT post_id, meta_key, meta_value FROM wp_postmeta \
  WHERE meta_key IN ('webpushr_notification_title','webpushr_notification_body') \
  AND (meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%' OR meta_value LIKE '%javascript:%');"