Threat database

WPAdverts – Classifieds Plugin for WordPress versions up to and including 2.3.4 is vulnerable to stored cross-site scripting (XSS) via the 'adverts_location' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue arises from insufficient input sanitization and output escaping.

CVE-2026-102878 is a high-severity vulnerability in mcp-chrome-bridge up to version 1.0.31. It involves an origin validation error in the native-server HTTP API that allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. This flaw enables malicious web pages to make unauthorized cross-origin requests to the local server, potentially invoking browser automation features such as script execution, reading page content, and capturing screenshots.

The WPAdverts – Classifieds Plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 2.3.2. This flaw allows unauthenticated attackers to access internal site configuration data via the classifieds-types REST endpoint. The exposed data includes registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.