Authenticated Users Inject Stored XSS via Plugin Configuration

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Adwised Web Push Notification WordPress plugin through version 2.5.7 contains a critical Stored Cross-Site Scripting (CWE-79) vulnerability that allows any authenticated user—including low-privilege subscribers—to inject malicious JavaScript into site-wide configuration settings. Because the plugin fails to validate user capabilities or verify nonces before accepting configuration changes, and subsequently fails to escape these values before rendering them in inline script blocks on every front-end page, attackers can execute arbitrary code in the browsers of all site visitors, including administrators. This amplifies the threat significantly: a compromised subscriber account becomes a pivot point for site-wide compromise, credential theft, and lateral attacks against administrative users.

Casky's 323 matched skills map this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via Social Engineering), enabling detection of the attack chain. Practitioners using Casky's Claude-powered analysis would observe skill findings highlighting: (1) privilege escalation patterns where low-privilege authenticated sessions modify high-impact configuration objects without authorization checks, (2) data exfiltration signals from inline script injection in front-end responses, and (3) persistence indicators showing malicious payloads embedded in application configuration that execute on every page load. The extended reasoning capability would correlate these signals—authentication without authorization validation, output rendering without sanitization—to identify this as a classic pre-authentication-to-XSS attack pattern, surfacing it as a high-priority finding before exploitation occurs at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87761.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-87761

Casky has 323 skills that investigate the attack patterns behind CVE-2026-87761. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn