CVE-2026-87761

Summary

The Adwised Web Push Notification plugin allows any authenticated user to overwrite critical site configuration and inject malicious scripts into every page, enabling stored XSS attacks against all visitors including administrators.

Exploitability

Exploitation requires an authenticated user account (such as a subscriber) with access to the plugin's configuration interface, which is relatively easy to achieve through social engineering or compromised credentials.

Blast radius

The vulnerability affects all front-end page views across the entire site, potentially compromising every visitor including administrators who may have elevated privileges and sensitive session data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Adwised Web Push Notification plugin immediately or upgrade to version 2.5.8 or later to address the stored XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.