All vulnerabilities
CVE-2026-87762

Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling

Unknown Adwised Web Push Notification
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published11 Oct 2026Updated 11 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.

Text from CVE List

Affected versions 1

  • Adwised Web Push Notificationaffected: all versions through 2.5.7CVE List

References 1