Vulnerability · Published Oct 11, 2026 · Assigned by WPScan

CVE-2026-87761Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

High 8.0

In plain English

A high-severity cross-site scripting in Adwised Web Push Notification from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.3%top 80.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Adwised Web Push Notification	0 – through 2.5.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/862d0ae8-eb6a-4a39-a941-597892c40eb0/ exploit, vdb-entry, technical-description