CVE-2026-87762: CWE-79 Cross-Site Scripting (XSS) in Adwised Web Push Notification
Description
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.
CVSS v3.1
Score 8.8high
Affected software
Adwised Web Push Notification
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87762 is a Cross-Site Scripting (XSS) vulnerability in the Adwised Web Push Notification WordPress plugin versions up to 2.5.7. The plugin lacks proper authorization checks on certain state-changing operations and relies on a secret key comparison that can be bypassed if the secret key is unset. This flaw enables unauthenticated attackers to store arbitrary JavaScript payloads that execute in the context of every visitor's browser, potentially leading to session hijacking, defacement, or other client-side attacks.
Potential Impact
Unauthenticated attackers can inject and execute arbitrary JavaScript in the browsers of all visitors to the affected site. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected website's users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should verify whether the secret key has been set and consider disabling or removing the plugin if possible to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-09T07:22:43.303Z
- State
- PUBLISHED
Threat ID: 6acb2de32cdf04f656b78d0d
Added to database: 10/11/2026, 06:34:11 UTC
Last enriched: 10/11/2026, 07:03:16 UTC
Last updated: 10/11/2026, 21:33:37 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.