CVE-2026-97264
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.
Risk Assessment
The risk includes session theft, user account takeover, or unauthorized actions in the context of a logged-in user, potentially compromising data confidentiality and integrity.
Recommendation
Update WPAdverts to a patched version and apply proper input filtering and encoding to prevent XSS attacks.
Other vulnerabilities in WPAdverts
See all- CVE-2026-57366High
The WPAdverts plugin version 2.3.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-97263High
WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.
- CVE-2026-84819High
The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.
- CVE-2026-40782Medium
WPAdverts versions <= 2.3.0 have an issue with unauthenticated access that can lead to broken access control.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS