CVE-2026-57366
HighCVSS 7.1Summary
The WPAdverts plugin version 2.3.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or unauthorized content modification on the website.
Recommendation
It is recommended to immediately update the WPAdverts plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in WPAdverts
See all- CVE-2026-97264High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.
- CVE-2026-97263High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.
- CVE-2026-84819High
The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.
- CVE-2026-40782Medium
WPAdverts versions <= 2.3.0 have an issue with unauthenticated access that can lead to broken access control.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS