CVE-2026-87762: Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to unauthenticated exploitation?
Installations running the plugin through version 2.5.7 are exposed when the plugin's secret key has never been set. In that condition, an unauthenticated user can bypass the secret comparison.
What access does an attacker need?
No authentication is required when the secret key has not been configured. The attacker can use state-changing operations that lack authorization checks to store arbitrary JavaScript.
What is the impact on site visitors?
The stored JavaScript is executed in the browser of every site visitor. This makes the issue a stored cross-site scripting vulnerability affecting visitor sessions rather than only an administrative interface.