CVE-2026-97263: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Greg Winiarski WPAdverts

The WPAdverts plugin for WordPress, versions from initial through 2.3.4, contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that persist on the site and execute in the context of users' browsers, potentially leading to data theft, session hijacking, or other impacts. The vulnerability is publicly known and assigned CVE-2026-97263 with a CVSS 3.1 score of 7.1. There is no vendor advisory or patch information provided, and no known active exploitation is reported.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, impacting confidentiality, integrity, and availability of user data and sessions. This can facilitate attacks such as session hijacking, defacement, or redirection to malicious sites. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that can be rendered on pages or applying web application firewall (WAF) rules to detect and block XSS payloads. Monitor official Greg Winiarski WPAdverts channels for updates and patches.