CVE-2026-87761: CWE-79 Cross-Site Scripting (XSS) in Adwised Web Push Notification

CVE-2026-87761 is a stored cross-site scripting vulnerability in the Adwised Web Push Notification WordPress plugin versions up to 2.5.7. The plugin does not verify user capabilities or use nonce checks before allowing authenticated users to modify site-wide configuration settings. These settings are then output without proper escaping inside inline JavaScript on every front-end page. This flaw permits any authenticated user, such as a subscriber, to inject malicious scripts that execute in the browsers of all site visitors, including administrators.

An attacker with any authenticated user account can inject malicious JavaScript code that will execute in the browsers of all visitors to the site. This can lead to session hijacking, privilege escalation, or other attacks against users, including administrators. The vulnerability affects the confidentiality and integrity of user sessions and site data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and consider disabling or replacing the plugin to prevent exploitation.