{"id":"CVE-2026-87761","published":"2026-10-11T07:17:26.690","lastModified":"2026-10-13T20:36:00.850","description":"The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/862d0ae8-eb6a-4a39-a941-597892c40eb0/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Adwised Web Push Notification plugin allows any authenticated user to overwrite critical site configuration and inject malicious scripts into every page, enabling stored XSS attacks against all visitors including administrators.","exploitability":"Exploitation requires an authenticated user account (such as a subscriber) with access to the plugin's configuration interface, which is relatively easy to achieve through social engineering or compromised credentials.","blast_radius":"The vulnerability affects all front-end page views across the entire site, potentially compromising every visitor including administrators who may have elevated privileges and sensitive session data.","remediation":"Disable the Adwised Web Push Notification plugin immediately or upgrade to version 2.5.8 or later to address the stored XSS vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","plugin","configuration"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:00.644Z"}}