high8.0
CVE-2026-87761
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwr…
Impact
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
Affected products
| Product | Affected versions |
|---|---|
| Adwised Web Push Notification WordPress Plugin | through 2.5.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.