---
id: CVE-2026-87761
title: >-
  The Adwised Web Push Notification WordPress plugin through 2.5.7 does not
  perform any capability or nonce check before allowing an authenticated user to
  overwrite its site-wide configuration, and does not escape those configuration
  value…
summary: >-
  The Adwised Web Push Notification WordPress plugin through 2.5.7 does not
  perform any capability or nonce check before allowing an authenticated user to
  overwrite its site-wide configuration, and does not escape those configuration
  value…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:17:25.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87761'
references:
  - url: 'https://wpscan.com/vulnerability/862d0ae8-eb6a-4a39-a941-597892c40eb0/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.722Z'
epss: 0.0017
epssPercentile: 0.05803
---

## Overview

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.