WPAdverts CVE-2026-97263

Exploitation requires an attacker to inject a script payload into a WPAdverts input field that is stored and later output without proper neutralization (stored XSS via the plugin's advert/content handling, versions through 2.3.4). Per the CVSS vector, triggering also requires victim user interaction (UI:R) - a privileged user or visitor must load the page containing the stored payload - which limits reliability and timing. The input vector asserts no privileges (PR:N), implying the injection point is reachable without authentication (consistent with a public advert-submission form), but the description does not name the specific field or confirm whether guest submission must be enabled; if WPAdverts requires an authenticated/contributor account to submit content, real-world privilege requirements are higher than PR:N suggests. The exact affected feature, parameter, and any non-default configuration dependency are not specified in the available data.

This is a moderate-severity (CVSS 7.1) stored cross-site scripting (CWE-79) issue in the WPAdverts WordPress plugin, reported by Patchstack. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates a network-reachable, low-complexity flaw requiring victim interaction, with a scope change reflecting the cross-origin nature of XSS. Several enrichment signals that would normally drive prioritization are entirely ABSENT from the input: there is no EPSS probability, no CISA KEV listing, and no indication of public POC/exploit code - so exploitation likelihood cannot be quantified and should not be assumed high. The PR:N (unauthenticated) metric is notable and somewhat atypical for stored XSS, which usually requires the attacker to have some ability to persist content; it is plausible here only if WPAdverts' public advert-submission workflow accepts guest input, but this is NOT confirmed by the description and should be verified against the Patchstack advisory. Net assessment: a real but not emergency-tier issue - a classic 'high-CVSS, unproven-real-world-risk' stored XSS where impact is limited (C:L/I:L) and gated by user interaction, warranting routine patching rather than crisis response.

An attacker submits a classified advert (or other user-supplied content) to a WPAdverts-powered site containing a malicious script payload that is stored and later rendered unsanitized. When a site administrator or another visitor views the affected page, the script executes in their browser session, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified at the time of analysis, and successful attack depends on a victim viewing the poisoned page (UI:R).