CVE-2026-93883

Name of the Vulnerable Software and Affected Versions Advanced Classifieds & Directory Pro versions prior to 3.4.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary web scripts via the phone parameter. These scripts execute when a user visits the affected page. Exploitation requires the acadp misc settings['force bootstrap'] setting to be enabled and the 'ACADP Listing Address' widget to be active on a sidebar of single listing pages.

Recommendations Update Advanced Classifieds & Directory Pro to version 3.4.5 or later. Disable the acadp misc settings['force bootstrap'] setting as a temporary mitigation. Remove the 'ACADP Listing Address' widget from sidebars on single listing pages to minimize risk.