CVE-2024-10890 is a reflected Cross-Site Scripting vulnerability in the WPAdverts – Classifieds Plugin for WordPress. The issue arises because the plugin uses add_query_arg and remove_query_arg functions without proper escaping of URL parameters, allowing injection of malicious scripts. This affects all plugin versions up to and including 2.1.7. An attacker can exploit this by crafting a malicious URL that, when visited by a user, executes arbitrary JavaScript in the user's browser. The vulnerability requires user interaction (clicking a link) and does not require authentication. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability affects confidentiality and integrity but does not impact availability. Since the attacker does not need authentication, any user visiting a maliciously crafted URL could be affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links related to the affected plugin. Monitoring for updates from the plugin vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.