The Adwised Web Push Notification WordPress plugin up to version 2.5.7 fails to check user capability or perform nonce validation before accepting configuration changes. It further outputs those configuration values unchanged inside an inline script block on every front‑end page. Consequently, any authenticated user, including a subscriber, can inject arbitrary JavaScript that will run in the browsers of all visitors, including site administrators. This flaw is a classic Stored Cross‑Site Scripting weakness that provides code execution on a wide audience.

WordPress sites that have the Adwised Web Push Notification plugin installed with a version of 2.5.7 or earlier. The vulnerability exists regardless of the site theme or other plugins because the inline script rendering is performed by the plugin on each front‑end page.

The flaw can be exploited by any authenticated user in environments where WordPress roles such as subscriber are enabled for the plugin's settings page; however, the EPSS score of < 1% indicates a low background likelihood of exploitation. With a CVSS score of 8.0, the combination of lack of capability checks and the ability to influence all visitors indicates a severe risk. The EPSS score is < 1%, and the vulnerability is not listed in KEV, but the potential for widespread user impact warrants immediate attention.