CVE-2026-87761
Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
HIGH 8.0EPSS 0.3%
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
- Affected
- Adwised Web Push Notification
- CVSS v3.1 CNA
- 8.0 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.28% chance of exploitation in the next 30 days, 19th percentile
- Published
- 2026-10-11