Executive brief
WPAdverts is a WordPress plugin for creating classified ads listings on websites. An unauthenticated attacker can inject malicious scripts into the site through user-accessible input, which would execute in the browsers of site visitors and could be used to steal customer data, hijack user accounts, or redirect visitors to malicious sites.
Technical details
The vulnerability is a reflected or stored cross-site scripting (XSS) flaw in WPAdverts plugin versions 2.3.3 and earlier. It allows unauthenticated attackers to inject arbitrary JavaScript code into web pages due to insufficient input validation or output encoding. Exploitation requires user interaction (e.g., clicking a crafted link or visiting an attacker-controlled page), but no authentication is needed. A successful exploit can steal session cookies, perform actions on behalf of the victim, or serve malware. The vulnerability was patched in version 2.3.4.
Affected products
- WPAdverts WPAdverts <= 2.3.3
Timeline
- 2026-09-10: disclosed
- 2026-09-08: patched: Fixed in version 2.3.4