CVE-2026-87761: Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed to the payload?
Any authenticated WordPress user, including a subscriber-level account, can overwrite the affected site-wide settings. The stored script is printed on every front-end page, exposing all visitors, including administrators.
What conditions are required for exploitation?
An attacker needs an authenticated account on a site running the affected plugin through version 2.5.7. No special capability or nonce validation is required before changing the vulnerable configuration.
How can I determine whether a site may be affected?
A site may be affected if it uses Adwised Web Push Notification version 2.5.7 or earlier and permits authenticated users such as subscribers. Review the plugin's pop-up settings for unexpected or suspicious values, since those values are rendered in an inline script on front-end pages.