Skip to content
Heist/ feed
Unrated

Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling

Type: advisorySource: Official CVE List1 source record

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.

Announced Source revision 1
Original source ↗

CVE-2026-87762

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87762

Adwised Web Push Notification

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Unknown",
    "product": "Adwised Web Push Notification",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "2.5.7"
      }
    ],
    "defaultStatus": "unknown"
  }
]
Related CVEs
CVE-2026-87762

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#16671 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement