EUVD-2026-96282
GHSA-prqm-578x-qhj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess public advert submission form
-
ExploitInject script into adverts_location field
-
ExecutionPayload stored and served on listing page
-
ImpactScript executes in admin/visitor browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the WPAdverts advert-submission feature expose the 'adverts_location' field to the attacker and that the plugin (≤2.3.4) store and render it without escaping on the generated listing page (blocks/list/templates/list-item.php and functions-blocks.php code paths). Unauthenticated exploitation per the stated PR:N holds only where the site permits anonymous/public ad posting; if registration, login, or pre-publish moderation is enforced, the attacker needs at least a low-privileged account or must rely on an administrator viewing the pending/submitted ad. The payload fires when any user - especially an administrator browsing listings - loads the injected page (victim page view is the trigger), making admin-session compromise the principal limiting-but-realistic condition. |
| Impact | Signals point to a moderate, not emergency, priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) describes network-reachable, low-complexity injection with no authentication and a scope change reflecting that the stored payload executes in the browsers of other users (notably site administrators). This is a classic stored XSS impact profile: Low confidentiality and Low integrity impact, no availability impact. No EPSS probability, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active or at-scale exploitation - the finding is a Wordfence-sourced research disclosure rather than a demonstrated in-the-wild threat. One tension to verify: the CVSS vector and description both claim PR:N (unauthenticated), but reaching the 'adverts_location' parameter unauthenticated depends on the WPAdverts advert-submission workflow permitting anonymous ad posting; in deployments requiring account registration or moderation before publish, real exploitation shifts toward low-privileged authenticated users and/or admin review of pending ads - verify the site's posting configuration. Net: a legitimate patch-soon issue because the scope change can lead to admin-session compromise, but absent EPSS/KEV/POC signals it is not a drop-everything emergency. |
| Exploit ScenarioDerived | On a WPAdverts site that allows public ad submission, an unauthenticated attacker posts a classified advert and places a malicious script in the location ('adverts_location') field, which is stored without sanitization and rendered unescaped on the listing page. When a site visitor or, more valuably, an administrator reviewing or browsing listings opens the injected page, the script executes in their browser, enabling session/cookie theft or admin actions. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Stored cross-site scripting in the WPAdverts - Classifieds Plugin for WordPress (all versions up to and including 2.3.4) allows attackers to persist arbitrary JavaScript in the 'adverts_location' advert field, which then executes in the browser of any user - typically an administrator - who views the affected classified listing. Because the plugin stores the field without sanitization and renders it without output escaping in its block-based listing templates, the assessment vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) treats the attack as unauthenticated, though in practice this holds only on sites that allow anonymous or public ad submission; if registration or pre-publish moderation is enforced, the attacker needs at least a low-privileged account or must rely on an administrator reviewing the pending ad. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this rates as a moderate, not emergency, priority - the realistic worst case is administrator session compromise when an admin browses the poisoned listing.
RemediationAI
No tagged release number beyond 2.3.4 is confirmed in the provided data; the fix appears as an upstream changeset in the plugin trunk (changeset 3732587, modifying includes/functions-blocks.php), so treat this as an upstream fix available (PR/commit) with a released patched version not independently confirmed - update WPAdverts to the newest available version and, until a fixed tagged release is verified, confirm the sanitization/escaping change is present in the deployed code. Where updating is not immediately possible, compensating controls with real trade-offs include: disable or require authentication for public ad submission (Settings for the adverts submission form) so the PR:N path disappears - this removes the unauthenticated vector but breaks anonymous classifieds posting and still leaves the pre-publish moderation path if a low-privileged user submits an ad an admin then views; remove the 'adverts_location' field from the ad submission form and listing templates via a child-theme/plugin filter so the tainted value is never stored or rendered - this eliminates the injection sink but drops location data from listings; and, as a containment measure, add a WAF/reverse-proxy rule that strips script and event-handler markup from requests carrying an adverts_location parameter, understanding that obfuscated payloads can bypass signature-based rules. Because the payload fires on page view, advise administrators to review pending/submitted adverts in a separate low-privilege browser session or with the listing preview rendered while logged out, and to rotate admin sessions if a suspicious listing was viewed. Track the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/84d362e2-a0ba-48e6-b4f5-46e080a7eee1?source=cve) and the plugin trunk changeset (https://plugins.trac.wordpress.org/changeset/3732587/wpadverts/trunk/includes/functions-blocks.php) for the authoritative fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPAdverts is a PHP WordPress plugin that adds a classifieds/advert workflow, including Gutenberg blocks for ad publishing and listing display. The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) instance on the 'adverts_location' parameter: the plugin accepts this value during ad submission but fails to sanitize it on input and fails to escape it on output, so markup supplied by the submitter is persisted and reflected verbatim into the generated page. The supplied source references pinpoint the vulnerable code paths in the 2.3.4 tag - the block rendering and helper functions in includes/functions-blocks.php (around lines 467 and 483), the listing item template at blocks/list/templates/list-item.php line 36, the ad data handling in includes/functions.php (lines 1878 and 1961), the field definition in includes/defaults.php line 150, and the submission engine at blocks/publish/class-publish-engine.php line 422 - with the corresponding trunk changeset (3732587) touching includes/functions-blocks.php, which indicates the fix was applied in the block-rendering/sanitization layer. The CPE cpe:2.3:a:gwin:wpadverts_-_classifieds_plugin confirms the affected component is the WPAdverts plugin distributed by vendor 'gwin' via the WordPress.org plugin repository. The CVSS scope change (S:C) reflects that script executing in the victim's browser can act outside the vulnerable component's own security context, i.e. against the WordPress administrative session.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Network-reachable unsanitized field reachable via public ad posting (PR:N/AV:N/AC:L); stored script executing in other users' browsers crosses a trust boundary (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WPAdverts - Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
WPAdverts - Classifieds Plugin for WordPress (all versions up to and including 2.3.4) contains a stored cross-site scripting flaw that allows crafted content submitted into the 'adverts_location' advert field to execute in the browser of any user who later views the affected classified listing, most critically site administrators. Sites that accept public or anonymous ad submissions are exposed without any credentials, so a low-effort submission could be leveraged to hijack an administrator's authenticated session and take control of the WordPress installation, its content, and any data it hosts. No vendor-released patch is currently available, so exposure persists until engineering applies compensating controls or the vendor ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate the WPAdverts plugin where feasible; disable anonymous/public ad submission and require registration plus pre-publish moderation; sanitize and output-encode the 'adverts_location' field via WAF virtual patching or a custom filter; audit and purge existing advert listings for injected script content; restrict and monitor wp-admin access; and rotate administrator credentials and sessions on affected sites.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB