CVE-2026-40782
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
WPAdverts versions <= 2.3.0 have an issue with unauthenticated access that can lead to broken access control.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially compromising information confidentiality.
Recommendation
It is recommended to update WPAdverts to the latest version to mitigate this vulnerability.
Other vulnerabilities in WPAdverts
See all- CVE-2026-57366High
The WPAdverts plugin version 2.3.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-97264High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.
- CVE-2026-97263High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.
- CVE-2026-84819High
The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.
Original NVD description (English source)
Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS