# CVE-2026-84819: WPAdverts unauthenticated cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-84819-wpadverts-unauthenticated-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84819 · Severity: high · CVSS 7.1 · Published 2026-09-10

WPAdverts is a WordPress plugin for creating classified ads listings on websites. An unauthenticated attacker can inject malicious scripts into the site through user-accessible input, which would execute in the browsers of site visitors and could be used to steal customer data, hijack user accounts, or redirect visitors to malicious sites.

Technologies: [WPAdverts](https://junglewise.ai/threats/technologies/wpadverts). Vendors: [WPAdverts](https://junglewise.ai/threats/vendors/wpadverts).

## Quick answers

**Is CVE-2026-84819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84819 being exploited in the wild.

**How severe is CVE-2026-84819?** High severity, with a CVSS score of 7.1, published 10 September 2026.

**Which products and versions are affected?** WPAdverts <= 2.3.3.

**Is there a fix for CVE-2026-84819?** A patch was published on 2026-09-08: Fixed in version 2.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84819 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84819?** Check whether you run WPAdverts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected or stored cross-site scripting (XSS) flaw in WPAdverts plugin versions 2.3.3 and earlier. It allows unauthenticated attackers to inject arbitrary JavaScript code into web pages due to insufficient input validation or output encoding. Exploitation requires user interaction (e.g., clicking a crafted link or visiting an attacker-controlled page), but no authentication is needed. A successful exploit can steal session cookies, perform actions on behalf of the victim, or serve malware. The vulnerability was patched in version 2.3.4.

## Affected products

- WPAdverts WPAdverts <= 2.3.3

## Timeline

- 2026-09-10: disclosed
- 2026-09-08: patched: Fixed in version 2.3.4

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [WPAdverts plugin broken access control](https://junglewise.ai/threats/cve-2026-40782-wpadverts-plugin-broken-access-control)