CVE-2026-87761 Adwised CVE debrief

Who should care

Site administrators and security teams responsible for WordPress installations with the Adwised Web Push Notification plugin should assess their exposure and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-87761 is a Stored Cross-Site Scripting vulnerability in the Adwised Web Push Notification WordPress plugin. Defenders should verify exposure, restrict configuration access, and implement additional security measures to prevent exploitation.

• Potential for authenticated users to perform Stored Cross-Site Scripting attacks against visitors and administrators
• Risk of unauthorized configuration changes to the plugin
• Possible impact on site integrity and user trust

Technical summary

The Adwised Web Push Notification WordPress plugin through 2.5.7 is vulnerable to Stored Cross-Site Scripting attacks. An authenticated user can overwrite the site-wide configuration without capability or nonce checks, and the configuration values are not escaped before being printed in an inline script block on every front-end page. This allows any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators. Defenders should prioritize verifying exposure of the Adwised Web Push Notification WordPress plugin version 2.5.7 or earlier in their environment, especially for sites with multiple contributors or users with authenticated access

Defensive priority

Defenders should prioritize verifying exposure of the Adwised Web Push Notification WordPress plugin version 2.5.7 or earlier in their environment, especially for sites with multiple contributors or users with authenticated access.

Recommended defensive actions

• Verify the version of the Adwised Web Push Notification WordPress plugin is up-to-date
• Restrict access to the plugin's configuration to authorized users only
• Implement additional security measures to detect and prevent Stored Cross-Site Scripting attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan. Defenders should verify exposure by checking the Adwised Web Push Notification WordPress plugin version and reviewing configuration access controls. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.