HIGH 8.8 NVD

CVE-2026-87762

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret compari

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.

References

https://wpscan.com/vulnerability/7e76c496-9098-405f-a85b-4363d476d895/

Published: 2026-10-11 · Source: NVD · Feed updated: 2026-10-12

This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-11 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.