CVE-2026-100178

Deferred Deferred - Pending Action

Stored XSS in WPAdverts WordPress Classifieds Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Wordfence

Description

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100178

EUVD

EUVD-2026-96282

Affected Vendors & Products

Vendor	Product	Version / Range
gwin	WPAdverts	– Classifieds Plugin 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WPAdverts – Classifieds Plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in versions up to 2.3.4. The flaw exists in the 'adverts_location' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject malicious scripts into pages, which execute when users access those pages.

Detection Guidance

Check for WordPress sites using the WPAdverts – Classifieds Plugin version 2.3.4 or older. Inspect pages for injected scripts in the 'adverts_location' parameter. Use security plugins like Wordfence to scan for malicious scripts.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your WordPress site. If exploited, it could lead to theft of user sessions, defacement of pages, or redirection to malicious sites. Users visiting infected pages may have their data compromised or be exposed to further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR and HIPAA requirements for data protection. It may result in data breaches, triggering legal penalties, fines, or reputational damage due to non-compliance with security and privacy standards.

Mitigation Strategies

Update the WPAdverts – Classifieds Plugin to the latest version. If an update is unavailable, consider disabling the plugin temporarily. Implement a web application firewall to block XSS attempts.

Hi! I’m here to help you understand CVE-2026-100178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70