Description

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-10-11T07:17:26.690Z",
  "pubdate": "2026-10-11T07:17:26.690Z",
  "executiveSummary": "The Adwised Web Push Notification WordPress plugin, in versions through 2.5.7, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from a critical lack of access control and input validation within the plugin's configuration management functionality.\nThe vulnerability allows any authenticated user, including those with minimal privileges such as subscribers, to modify global plugin settings. Because the application fails to sanitize these inputs before rendering them, an attacker can inject malicious JavaScript payloads. These scripts are subsequently executed in the context of any user visiting the site, including site administrators.\nThe primary risk implication is full account compromise or unauthorized administrative action via session hijacking. The exploitation requires only a valid WordPress user account, making this a significant threat to sites allowing subscriber registrations. Successful exploitation results in persistent, site-wide code execution across the front-end, compromising the integrity and security of all visitor sessions.",
  "technicalDetails": "The root cause of this vulnerability is a deficiency in the plugin's authorization and sanitization logic. The application fails to implement capability checks (such as 'manage_options') or cryptographic nonce verification on the endpoint responsible for updating the plugin's site-wide configuration. This allows any authenticated WordPress user to perform unauthorized POST requests to update the configuration settings.\nFurthermore, the plugin fails to perform adequate output escaping when reflecting these configuration values. The values are retrieved from the database and printed directly into an inline script block within the HTML output of every front-end page. This design flaw converts legitimate configuration fields into an injection vector for malicious payloads.\nThe attack flow proceeds as follows: 1) An attacker with a low-privileged account (subscriber) identifies the request parameters used to update the plugin settings. 2) The attacker crafts a request containing a malicious JavaScript payload injected into a configuration field. 3) Because the backend does not validate the request's origin or the user's permissions, the database is updated with the payload. 4) The plugin subsequently renders this payload within an inline <script> block on every page load. 5) When a victim—such as an administrator—visits any page on the site, the browser executes the payload. 6) The injected script can then perform unauthorized actions on behalf of the victim, such as exfiltrating session tokens, creating new administrative accounts, or redirecting users to malicious domains.\nThe vulnerability affects all versions up to 2.5.7. It is classified as Stored XSS because the payload is permanently saved in the WordPress database, ensuring that the attack is executed every time the affected pages are loaded by any user. Due to the lack of nonce protection, the endpoint is also susceptible to Cross-Site Request Forgery (CSRF) if the attacker can trick an authenticated user into visiting a malicious site, although the ability for the attacker to directly modify settings makes this a direct authorization failure."
}