WPAdverts EUVD-2026-96325

Exploitation requires an attacker to deliver a crafted link containing the XSS payload and have a victim click it (UI:R in the CVSS vector), with the payload reflected by an unsanitized WPAdverts input parameter during web page generation. No authentication is required of the attacker (PR:N), but impact is realized in the victim's authenticated session, so the practical payoff is highest when the victim is a privileged/admin user. Key limiting factors: the dependence on social-engineering the victim into clicking, the reflected (non-persistent) nature meaning the payload is not stored server-side, and applicability only to WPAdverts versions through 2.3.4 on WordPress sites exposing the affected parameter.

This is a reflected cross-site scripting (XSS) flaw in the WPAdverts WordPress plugin (versions up to and including 2.3.4), scored CVSS 7.1 by the Patchstack reporter. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates a network-reachable, low-complexity issue requiring no attacker privileges but requiring victim interaction (UI:R), with a changed scope reflecting that injected script executes in the victim's browser outside the vulnerable component's security boundary. No EPSS score, CISA KEV listing, SSVC decision data, or public proof-of-concept was supplied in the input, so exploitation likelihood cannot be quantified from the data provided. In practical terms this is a typical reflected-XSS priority: the 7.1 score is driven largely by the scope change and triple low impacts rather than by any signal of mass exploitation. Reflected XSS requires luring an authenticated or privileged user to click a crafted link, which meaningfully constrains real-world impact compared with stored XSS or unauthenticated RCE. Absent KEV/EPSS/POC signals, this should be treated as a standard-severity patch-when-practical item rather than an emergency, though sites exposing WPAdverts listing/search parameters to untrusted input should patch promptly.

An attacker crafts a malicious URL targeting a vulnerable WPAdverts parameter that reflects unsanitized input into the page, then delivers it via phishing email, forum post, or malicious link to a logged-in site administrator or user. When the victim clicks the link, attacker-controlled JavaScript executes in their browser session in the context of the WordPress site, enabling session/cookie theft, admin-action forgery, or redirection. No public exploit code was identified in the provided data, and successful exploitation depends on the required user interaction (UI:R).