Adwised Web Push Notification: Stored XSS via settings by authenticated users
Summary
The Adwised Web Push Notification WordPress plugin up to and including version 2.5.7 does not check capabilities or nonces when saving its site-wide configuration. It also does not escape these values when printing them in an inline script on every front-end page. A user with a low-privilege account, such as a subscriber, can store malicious JavaScript that runs in the browsers of all visitors, including administrators.
Affected
- Adwised Web Push Notification WordPress plugin, all versions up to and including 2.5.7
- Vendor and exact product identity not confirmed in the CVE data
Fixed in
Unknown. No vendor advisory or confirmed fixed release was found.
Workaround
- Deactivate and remove the plugin if web push notifications are not required
- Review accounts with subscriber or higher roles and disable open self-registration if it is not needed
- Check the plugin's stored settings and front-end inline scripts for unexpected script content and remove any found
- Check administrator accounts for unexpected changes
Exploitation
- No known exploitation in the wild
- Not listed in CISA KEV
- No public proof of concept found
- CISA SSVC: exploitation none, automatable no
Our recommendation
- Identify all WordPress sites running this plugin, including versions up to 2.5.7
- Remove the plugin if it is not needed
- If it is needed, treat the site as at risk until a fixed release is confirmed from the vendor or wordpress.org, and apply the update as soon as it is available
- Also check CVE-2026-87762, which affects the same plugin
- Monitor the front-end and admin accounts for signs of script injection
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- Vulners NVD record CVE-2026-87761 vulners.com
- OpenCVE CVE-2026-87761 app.opencve.io
- Patchstack entry vulners.com
- VulDB entry 416525 vuldb.com
- VulDB entry 416507 (related CVE-2026-87762) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:28.
Original description (NVD)
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.