Stored Cross-Site Scripting Vulnerability in Adwised Web Push Notification Plugin
CVE-2026-87761

Currently unrated

Key Information:

Vendor

WordPress
Status
Adwised Web Push Notification
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-87761?

The Adwised Web Push Notification plugin for WordPress, prior to version 2.5.7, lacks sufficient capability checks, allowing authenticated users to overwrite global configuration settings. It directly injects unvalidated values into inline scripts across all front-end pages, thereby enabling potential Stored Cross-Site Scripting attacks. This vulnerability exposes all users, including site administrators, to possible exploitation through malicious scripts crafted by authenticated users such as subscribers.

Affected Version(s)

Adwised Web Push Notification 0 <= 2.5.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-87761 - Proof of Concept

References

https://wpscan.com/vulnerability/862d0ae8-eb6a-4a39-a941-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • đź‘ľ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo González Pérez
Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
WPScan
.