CVE-2026-100178: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gwin WPAdverts – Classifieds Plugin

CVE-2026-100178 describes a stored cross-site scripting vulnerability in the WPAdverts – Classifieds Plugin for WordPress. The vulnerability exists in all versions up to and including 2.3.4, where the 'adverts_location' parameter is not properly sanitized or escaped. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 7.2, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope changed.

Successful exploitation can lead to arbitrary script execution in the context of users accessing the injected pages, potentially resulting in theft of user credentials, session hijacking, or other malicious actions affecting confidentiality and integrity. There is no impact on availability. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable parameter or plugin functionality to mitigate risk. Monitor the vendor's communications for updates on patches or official fixes.