What is the CVSS score of CVE-2026-57366?

CVE-2026-57366 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WPAdverts are affected by CVE-2026-57366?

WPAdverts WordPress plugin (versions 2.3.1 and earlier) contains a reflected XSS vulnerability that allows unauthenticated attackers to execute malicious JavaScript in visitors' browsers through…

How to fix or mitigate CVE-2026-57366?

Within 24 hours: audit all WordPress installations for WPAdverts plugin versions 2.3.1 and earlier; identify affected systems and disable the plugin if it is not business-critical. Within 7 days: implement Web Application Firewall (WAF) rules to block common XSS payloads, enforce Content-Security-Policy headers, and enable strict input validation on all user-submitted content; consider restricting access to the plugin's endpoints. Within 30 days: monitor vendor security advisories for a patched version and schedule immediate upgrade upon release.

WPAdverts CVE-2026-57366

EUVD-2026-41362 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-qxv2-cxmc-87mq

WordPress XSS Wordpress Plugin Wpadverts

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated reflected XSS (PR:N, UI:R) executing in the browser context gives S:C with low C/I impact; availability is unaffected, so A:N rather than A:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:18 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

AnalysisAI

Reflected/unauthenticated Cross-Site Scripting in the WPAdverts WordPress classifieds plugin (versions 2.3.1 and earlier) lets a remote, unauthenticated attacker inject arbitrary JavaScript that executes in a victim's browser when they open a crafted link or view attacker-controlled input. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects a low-complexity network attack needing only user interaction, with a scope change into the browser security context. No public exploit was identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The affected component is WPAdverts (vendor 'greg_winiarski', per CPE cpe:2.3:a:greg_winiarski:wpadverts), a plugin that adds classified-ad listing functionality to WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data is echoed into HTML output without proper sanitization or output encoding. Because the injection is reachable without authentication (PR:N), the vulnerable code path is exposed on public-facing ad submission, search, or listing parameters where WordPress/PHP rendering fails to escape attacker input before it reaches the DOM.

RemediationAI

No vendor-released patch version was identified in the available data; the input only confirms that versions 2.3.1 and earlier are affected, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-plugin-2-3-1-cross-site-scripting-xss-vulnerability) and upgrade to the first release above 2.3.1 as soon as the maintainer publishes it. As interim compensating controls, deploy a WordPress-aware WAF or virtual patch (Patchstack offers one) to filter script payloads on WPAdverts request parameters, restrict or disable public ad-submission and search endpoints if they are not business-critical (trade-off: legitimate users lose self-service listing), and enforce a strict Content-Security-Policy that disallows inline script to blunt reflected payload execution (trade-off: may break inline scripts in the theme and must be tested). Avoid distributing untrusted WPAdverts links to logged-in administrators until patched.