Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows… (CVE-2026-97264)

CVE-2026-97264 describes a reflected cross-site scripting (XSS) vulnerability in the WPAdverts plugin by Greg Winiarski. The issue arises from improper neutralization of input during web page generation, allowing malicious scripts to be reflected back to users. This affects all versions of WPAdverts up to and including 2.3.4. The vulnerability has a CVSS v3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting WPAdverts. Avoid clicking on suspicious links that may exploit this vulnerability.