CVE-2026-84819
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.
Risk Assessment
An attacker can execute malicious JavaScript in a victim's browser, potentially leading to session or credential theft.
Recommendation
Update the WPAdverts plugin to a version newer than 2.3.3 or disable it if no update is available.
Other vulnerabilities in WPAdverts
See all- CVE-2026-97264High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.
- CVE-2026-97263High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.
- CVE-2026-57366High
The WPAdverts plugin version 2.3.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-40782Medium
WPAdverts versions <= 2.3.0 have an issue with unauthenticated access that can lead to broken access control.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS