8 matches found
CVE-2026-87762
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...
CVE-2026-87761
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...
CVE-2026-87762 Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...
EUVD-2026-96771
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...
EUVD-2026-96770
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...
CVE-2026-87762
The Adwised Web Push Notification WordPress plugin (versions up to and including 2.5.7 ) is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin lacks authorization checks on several state-changing operations. Furthermore, a secret comparison mechanism can be bypassed on ...
CVE-2026-87761
The Adwised Web Push Notification WordPress plugin, in versions through 2.5.7 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a lack of capability or nonce checks when allowing authenticated users to overwrite site-wide configurations, combined with a failure to es...
CVE-2026-87761 Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...