CVE-2026-100178: WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advertslocation' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated attacker can exploit the issue remotely with low attack complexity. No privileges or user interaction are required for injection, but the stored script executes when a user visits an affected injected page.
Which deployments are affected?
WPAdverts – Classifieds Plugin versions up to and including 2.3.4 are affected. The issue is associated with handling of the adverts_location parameter.
What is the likely impact if exploitation succeeds?
An attacker can store arbitrary web script that runs in the browser of users who access an injected page. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.