Adwised Web Push Notification
Monthly
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.