The WPFactory Adverts plugin (versions up to 1.4) contains a DOM-based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation in the adverts-click-tracker component. This allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 6.5, reflecting a medium severity level. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium due to the requirement for user interaction and low privileges, and the limited scope of confidentiality, integrity, and availability impacts as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that interacts with the adverts-click-tracker component and applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin.