WordPress Push Notification Plugin Unauthenticated Stored XSS

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Adwised Web Push Notification WordPress plugin through version 2.5.7 contains a critical stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript in the browsers of all site visitors. The flaw stems from missing authorization checks on state-changing operations combined with a bypassable secret comparison mechanism—particularly when the secret key has never been initialized. This affects any WordPress installation running the vulnerable plugin, making it a high-impact threat to website integrity and visitor security. Attackers can exploit this to steal credentials, redirect users, inject malware, or deface content at scale.

Casky's 323 matched security skills leverage Claude's extended reasoning to detect the attack patterns mapped to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via web application probing). Practitioners using Casky will identify indicators including: unauthorized modification of push notification payloads (CWE-79 execution path), absence of CSRF/authorization token validation on plugin endpoints, and detection of JavaScript injection attempts in notification storage mechanisms. The platform's skills enable detection of both the initial reconnaissance phase—where attackers probe for uninitialized plugin configurations—and the execution phase where malicious scripts reach visitor browsers. Security teams will see findings highlighting missing input sanitization, absent authentication checks on administrative functions, and opportunities to implement content security policies to prevent stored XSS execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87762.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-87762

Casky has 323 skills that investigate the attack patterns behind CVE-2026-87762. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn