Adwised Web Push Notification CVE-2026-87762

Exploitable only on Adwised Web Push Notification installations (through version 2.5.7) where the plugin's secret key has never been set - the broken secret comparison can only be bypassed in that unconfigured state, so sites that configured a secret are not affected. The vulnerable operations are several state-changing plugin actions that lack authorisation checks. Limiting factors: (1) the never-set-secret precondition excludes hardened/fully-configured installs; (2) per the CVSS UI:R metric, the stored payload only fires when a site visitor loads an affected page; (3) only versions ≤2.5.7 are affected per EUVD.

Multiple signals converge on this being a genuine, actionable priority rather than CVSS inflation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated stored XSS, and a public exploit is confirmed via WPScan, raising practical exploitability. However, exploitation status is 'publicly available exploit code exists' - NOT active exploitation: this CVE is not listed in CISA KEV, so it should not be treated as in-the-wild. EPSS is MISSING from the input, so no exploitation-probability signal is available to corroborate the POC - do not assume high EPSS from POC existence alone. No SSVC decision data (automatable, technical impact, exploitation status) was supplied. One important nuance tempers the raw 8.8: the flaw is only exploitable on installations where the secret key has never been set, meaning hardened/fully-configured sites may not be affected - this makes the real-world population narrower than a blanket AV:N/PR:N reading implies. Note also a scoring tension: the input lists S:U with C:H/I:H/A:H, which is unusually high for browser-context stored XSS; the high impacts likely reflect potential admin-session compromise rather than direct server impact - verify against WPScan's own rationale.

An unauthenticated attacker targets a WordPress site running Adwised Web Push Notification ≤2.5.7 whose plugin secret key was never configured, and sends a crafted state-changing request that bypasses the broken secret comparison to store malicious JavaScript. When any visitor - including a logged-in administrator - subsequently loads an affected page, the stored script executes in their browser, enabling session/cookie theft or admin-account takeover. A public exploit for this issue is already available via WPScan.