CVE-2026-87761

19th percentile - higher than 19% of all known CVEs

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.

Stored XSS can lead to administrator and visitor session hijacking, data theft, or spreading malware across the site.

Update the Adwised Web Push Notification plugin to the latest version that includes security fixes. If not available, consider removing or disabling it until a patch is released.