Known vulnerabilities in Push Notification for Post and BuddyPress

Push notifications for WordPress post, BuddyPress, WooCommerce with PWA support, mobile app integration, and AI Notification drafts.

5Reported vulnerabilities

9.8Highest CVSS score

3.20Latest version

200+Active installs

What to do now

Update Push Notification for Post and BuddyPress to 3.21 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 19, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-6159	Critical 9.8	2.8%	Before 1.9.4	`1.9.4`	May 15, 2025
CVE-2024-12407	Medium 6.1	0.4%	0 to 2.06 (inclusive)	`2.08`	January 11, 2025
CVE-2025-23771	Medium 5.3	0.4%	2.11 and earlier	`2.12`	January 16, 2025
WF-228a3c72-fbb0-48bc-8066-6ca954a14421	Medium 5.3	—	Before 1.64	`1.64`	August 22, 2023
CVE-2026-81279	Medium 4.3	0.2%	3.20 and earlier	`3.21`	August 26, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.