Adwised Web Push Notification WordPress plugin: Unauthenticated stored XSS
Summary
The Adwised Web Push Notification plugin for WordPress through version 2.5.7 lacks authorisation checks on several state-changing operations. Its secret key comparison can be bypassed on installations where the secret key was never set. An unauthenticated attacker can therefore store arbitrary JavaScript that runs in the browser of every site visitor.
Affected
- Adwised Web Push Notification WordPress plugin, versions up to and including 2.5.7
- Default configuration (secret key never set) is the condition for the bypass; the default status is otherwise unknown.
Fixed in
Unknown. WPScan lists no known fix. VulDB refers to version 2.5.8 or later, but this could not be verified against the vendor or the WordPress.org changelog.
Workaround
- Deactivate and remove the plugin if it is not essential.
- Setting a strong secret key may be tried, but no source confirms that it closes the issue, so treat it as untested.
- VulDB suggests disabling web push notifications if they are not required for business operations; this is a third-party recommendation, not an official vendor statement.
Exploitation
- No known exploitation in the wild. The CVE is not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- EPSS about 0.2%.
- A public proof of concept is unclear; the WPScan page should be checked directly.
Our recommendation
- Check whether the plugin is installed and active on your WordPress sites.
- Deactivate and remove the plugin if it is not essential; this also covers the related CVE-2026-87761.
- Review the database and site templates for unexpected script tags and review admin accounts.
- Monitor the vendor and WordPress.org for a confirmed fixed version.
- Note that the CVSS score is disputed (VulDB lists 4.3); prioritise based on the NVD score of 8.8.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- VulDB CVE-2026-87762 vuldb.com
- VulDB CVE-2026-87762 scoring entry vuldb.com
- OpenCVE CVE-2026-87762 app.opencve.io
- VulnCheck/Vulners Patchstack advisory vulners.com
- Adwised WordPress.org profile profiles.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:41.
Original description (NVD)
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.