Adwised Web Push EUVD-2026-96770

Requires an authenticated WordPress account of any role, including subscriber, because the plugin performs NO capability or nonce check on the configuration-overwrite action - this makes exploitation trivial on sites with open user registration (default WordPress 'Anyone can register' setting). The injected payload fires when any visitor loads any front-end page, so an administrator browsing the public site is a reliable victim. Limiting factors: (1) the attacker must hold at least one authenticated account (PR:L), so sites that disable self-registration raise the bar; (2) victim user interaction is needed in that someone must load a front-end page (UI:R), though this is near-certain given it affects every page; (3) the site must be running Adwised Web Push Notification version 2.5.7 or earlier.

This is a genuinely high-priority issue for affected sites, corroborated by multiple signals that mostly align. The vendor CVSS of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity exploitation requiring only a low-privilege authenticated account. WPScan - a reputable WordPress vulnerability source - reports the flaw and confirms publicly available exploit code exists, raising the practical likelihood of opportunistic abuse. However, this is not confirmed actively exploited: there is no CISA KEV listing and no EPSS score was provided in the input, so widespread in-the-wild exploitation cannot be asserted - treat exploitation likelihood as elevated-by-POC but unquantified. The most important nuance is privilege: the missing capability/nonce checks let ANY authenticated user (even a subscriber) overwrite site-wide config, which makes PR:L very cheap on WordPress sites that permit open user registration - effectively near-unauthenticated for those deployments. One signal to scrutinize is the impact rating: the vendor marks A:H, but a stored-XSS/CWE-79 flaw primarily yields session/credential theft and admin takeover rather than a direct availability outage, so A:H appears generous (see my independent assessment). Net: a real priority for any site running this plugin with registration enabled, but its absolute risk is bounded by the plugin's limited deployment footprint.

An attacker registers a low-privilege subscriber account (or uses any existing authenticated account) on a WordPress site running the vulnerable Adwised plugin, then sends a crafted request that overwrites the plugin's site-wide configuration with a malicious payload because no capability or nonce check is enforced. The unescaped value is subsequently printed inside an inline <script> block on every front-end page, so when an administrator or any visitor loads the site the JavaScript executes in their browser, enabling session/cookie theft or admin takeover. Publicly available exploit code (via WPScan) lowers the barrier to carrying this out.