CVE-2026-87761 in Adwised Web Push Notification Plugin
Summary
by MITRE • 10/11/2026
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in the Adwised Web Push Notification WordPress plugin versions prior to 2.5.7 represents a critical failure in both access control and output encoding mechanisms within a widely used content management system ecosystem. This flaw allows authenticated users with minimal privileges, such as subscribers, to execute stored cross-site scripting attacks against all visitors of the affected website, including high-privilege administrators. The root cause lies in two distinct but compounding security deficiencies: the absence of capability and nonce verification for administrative configuration actions, and the lack of proper sanitization when rendering user-supplied data into JavaScript contexts on public-facing pages.
From an access control perspective, the plugin fails to enforce appropriate role-based restrictions or verify nonces before processing requests that modify site-wide settings. In WordPress architecture, operations that alter global configurations are typically restricted to users with administrator-level capabilities and require a valid nonce to prevent Cross-Site Request Forgery attacks. By omitting these checks, the application inadvertently grants any authenticated user, regardless of their assigned role or permission level, the ability to inject arbitrary configuration values into the system database. This effectively bypasses the intended privilege escalation boundaries, allowing low-privilege accounts to perform actions reserved for site owners.
The second critical flaw involves improper output encoding when these maliciously injected configurations are rendered on front-end pages. The plugin takes the untrusted data stored in its configuration and inserts it directly into an inline script block without applying necessary escaping functions such as wp_json_encode or similar context-aware sanitization techniques. Because this code is executed by every visitor's browser, any JavaScript payload embedded within these settings will run automatically upon page load. This transforms a simple configuration injection into a persistent stored cross-site scripting vulnerability that affects the entire user base of the website rather than just the attacker’s session.
The operational impact of this vulnerability is severe and multifaceted. Attackers can steal administrative credentials by harvesting cookies or session tokens, redirect users to phishing sites designed to mimic legitimate login pages, deface the website content, or install malicious browser extensions through prompt injection techniques. Since the payload persists in the database, it continues to affect new visitors even after the initial attack is completed, creating a long-term security risk that requires manual intervention to fully remediate. The ability to target administrators specifically increases the likelihood of complete site compromise, potentially leading to server-level access or integration with other backend systems if further exploitation vectors exist.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under the stored variant where malicious scripts are permanently stored within target applications. Additionally, from a tactical perspective related to the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving client-side script injection and potentially credential harvesting through session hijacking. The lack of nonce verification also relates to CWE-352, Cross-Site Request Forgery (CSRF), as the action can be triggered by forged requests from other sites if combined with social engineering tactics.
To mitigate this vulnerability, immediate updates to version 2.5.7 or later are required, assuming the developer has addressed these specific flaws in subsequent releases. For organizations unable to update immediately due to compatibility constraints, temporary mitigations should include restricting access to the plugin’s configuration endpoints via web application firewall rules that block requests lacking valid nonces or requiring higher privilege levels for write operations on those specific paths. Furthermore, implementing strict Content Security Policy headers can help mitigate the impact of any remaining XSS vectors by preventing unauthorized script execution from unknown sources. Regular security audits focusing on input validation and output encoding practices across all plugins are essential to prevent similar issues in future deployments.