Advanced Classifieds Pro CVE-2026-93883

Exploitation requires ALL of the following: (1) an authenticated WordPress account with 'custom-level' access or higher on the target site (PR:L); (2) the 'Force Bootstrap' miscellaneous setting (acadp_misc_settings['force_bootstrap']) must be explicitly enabled - non-default; and (3) the 'ACADP Listing Address' widget must be placed in a sidebar that is displayed on single listing pages - non-default. The payload is injected via the 'phone' parameter of a listing. The combined requirement of a privileged account plus two operator-chosen, non-default configuration settings substantially limits real-world exploitability; sites running default Advanced Classifieds & Directory Pro configurations are not affected.

This is a genuinely moderate-to-low priority issue despite its CVSS 6.4 (Medium) rating, and the raw score overstates real-world risk. The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) treats exploitation as low-complexity, but the description explicitly states the flaw is ONLY exploitable when two non-default conditions are both met: the 'Force Bootstrap' misc setting (acadp_misc_settings['force_bootstrap']) is enabled AND the 'ACADP Listing Address' widget is placed on a sidebar shown on single listing pages. That contradicts the AC:L in the supplied vector - realistic attack complexity is High, which is why my independent assessment lowers the score. Exploitation also requires an authenticated account at 'custom-level access and above' (consistent with PR:L), not an anonymous attacker. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) and stored nature mean a successful inject executes in the browsers of other users (including potentially admins) viewing the listing page, which is the main reason this is not purely trivial. Net: a real but conditional stored XSS requiring an authenticated role plus two non-default configuration choices - patch in normal cycles rather than as an emergency.

An attacker who already holds a 'custom-level' or higher WordPress account on a vulnerable site submits a classified listing with a malicious script payload in the 'phone' field, which is stored without sanitization and rendered without escaping. On a site where 'Force Bootstrap' is enabled and the 'ACADP Listing Address' widget sits in a sidebar on single listing pages, the script then executes in the browser of any visitor or administrator who views that listing. No public exploit code was identified, and the attack only works against this specific non-default configuration.