CVE-2026-87761

Name of the Vulnerable Software and Affected Versions Adwised Web Push Notification versions prior to 2.5.8

Description An authenticated user, including those with subscriber-level privileges, can overwrite site-wide configuration settings because the plugin fails to perform capability or nonce checks. Furthermore, these configuration values are not escaped before being printed within an inline script block on every front-end page. This allows for Stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browsers of all visitors, including administrators.

Recommendations Update Adwised Web Push Notification to version 2.5.8 or later.