Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-10T14:16:38.250Z",
  "pubdate": "2026-10-10T14:16:38.250Z",
  "executiveSummary": "The WPAdverts plugin for WordPress, specifically versions n/a through 2.3.4, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw arises from improper neutralization of user-supplied input before rendering it in a web page.\nAn unauthenticated or authenticated attacker can inject malicious JavaScript into the application's database, which is subsequently executed within the context of a victim's browser session upon viewing the compromised page.\nThe impact includes the potential for session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive authentication cookies, and the redirection of users to malicious websites.\nThis vulnerability presents a significant risk to site integrity and user security, as it allows for the persistent execution of arbitrary code within the user's browser, bypassing standard site access controls.",
  "technicalDetails": "The vulnerability is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').\nThe root cause of the vulnerability lies in the failure of the WPAdverts plugin to properly sanitize or escape input fields before storing the data in the WordPress database and subsequently rendering that data within the administrative or front-end dashboards.\nBecause the application does not validate or encode the input during the storage phase, an attacker can supply a payload containing script tags (e.g., <script>alert(document.cookie)</script>) or event handlers (e.g., onerror, onload) into input vectors processed by the plugin.\nThe exploitation flow begins with the attacker identifying a vulnerable input field—such as a form field or settings configuration—within the WPAdverts plugin interface. The attacker submits the malicious payload, which is saved server-side without restriction.\nWhen a legitimate user, such as an administrator or another visitor, navigates to the compromised section of the web application where the stored input is rendered, the web browser interprets the injected data as executable code rather than plain text.\nThe execution happens client-side within the victim's browser session. Since the script executes under the origin of the WordPress site, it has full access to the Document Object Model (DOM), browser-stored cookies, and local storage.\nPost-exploitation activities include, but are not limited to, stealing session tokens to bypass authentication, modifying the DOM to display deceptive phishing content, or forcing the victim's browser to execute requests in the background (CSRF-like behavior).\nThe vulnerability affects WPAdverts versions through 2.3.4. Given that this is a Stored XSS variant, the malicious script is persistent and will execute every time the affected page is loaded, until the database entry is manually cleaned or the vulnerability is patched by the developer."
}