CVE-2026-87762

HighCVSS 8.8

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.

Risk Assessment

Stored XSS can lead to visitor session hijacking, data theft, or spreading malware to all site visitors.

Recommendation

Update the Adwised Web Push Notification plugin to the latest version that includes security fixes. If not available, consider removing or disabling it until a patch is released.

Other vulnerabilities in Adwised Web Push Notification WordPress plugin

CVE-2026-87761High
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS