CVE-2026-97263
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.
Risk Assessment
The risk includes persistent infection of the page, potentially leading to data theft, user account takeover, or malware distribution among visitors.
Recommendation
Update WPAdverts to a patched version and implement proper input validation and sanitization mechanisms to prevent stored XSS.
Other vulnerabilities in WPAdverts
See all- CVE-2026-57366High
The WPAdverts plugin version 2.3.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-97264High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.
- CVE-2026-84819High
The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.
- CVE-2026-40782Medium
WPAdverts versions <= 2.3.0 have an issue with unauthenticated access that can lead to broken access control.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS