CVE-2026-93883: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pluginsware Advanced Classifieds & Directory Pro

CVE-2026-93883 is a stored cross-site scripting vulnerability in the Advanced Classifieds & Directory Pro WordPress plugin. It arises from insufficient input sanitization and output escaping of the 'phone' parameter. The exploit requires two specific conditions: the 'Force Bootstrap' miscellaneous setting enabled and the 'ACADP Listing Address' widget placed on a sidebar on single listing pages. Authenticated attackers with custom-level access or above can inject arbitrary scripts that execute in the context of users viewing the injected pages. This affects all plugin versions from 0 up to and including 3.4.4.

Successful exploitation allows an authenticated attacker with custom-level access or higher to inject and execute arbitrary JavaScript in the browsers of users who visit the affected listing pages. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. The exploit requires specific non-default configuration settings, limiting its exposure.

No official patch or fix is currently documented. Users should verify if the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is used on single listing pages. Disabling the 'Force Bootstrap' setting or removing the widget from sidebars on single listing pages can mitigate the vulnerability. Monitor the vendor's advisory channels for updates and apply official patches when available.