CVE-2026-100178

HighCVSS 7.2

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to stored XSS via the 'adverts_location' parameter in all versions up to and including 2.3.4.

Risk Assessment

An unauthenticated attacker can inject arbitrary scripts that execute when a user visits an infected page, potentially leading to data theft, session hijacking, or malware distribution.

Recommendation

Update the WPAdverts plugin to the latest version that includes a security fix.

Other vulnerabilities in WPAdverts – Classifieds Plugin

CVE-2026-11801High
The WPAdverts – Classifieds Plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.3.2. Unauthenticated attackers can retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, taxonomies, form scheme metadata, contact options, and custom field meta keys.

Original NVD description (English source)

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS