{"id":"CVE-2026-87762","published":"2026-10-11T07:17:26.803","lastModified":"2026-10-13T20:36:00.850","description":"The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/7e76c496-9098-405f-a85b-4363d476d895/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Adwised Web Push Notification WordPress plugin has a critical authorization bypass vulnerability that allows unauthenticated users to inject and execute arbitrary JavaScript code on every visitor's browser. This occurs because the plugin lacks proper authorization checks and uses a vulnerable secret comparison method that can be bypassed when the secret key is unset.","exploitability":"Exploitation is straightforward with no prerequisites, requiring only access to the WordPress site to trigger the injection of malicious JavaScript through unprotected endpoints.","blast_radius":"The impact could be severe across all visitors since the injected JavaScript executes in every user's browser, potentially leading to session hijacking, data exfiltration, or full client-side compromise.","remediation":"Upgrade to version 2.5.8 or later to address the authorization bypass and secret comparison vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","wordpress","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:54:35.665Z"}}