CVE-2026-100178

Name of the Vulnerable Software and Affected Versions WPAdverts – Classifieds Plugin versions prior to 2.3.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the adverts location parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update WPAdverts – Classifieds Plugin to version 2.3.5 or later. Avoid using the adverts location parameter until the plugin is updated.