CVE-2026-100178highCWE-79

CVE-2026-100178: falha de alta gravidade em gwin WPAdverts – Classifieds Plugin

WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

Publicada em 10 out 2026 · Atualizada em 11 out 2026

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.4%

probabilidade de exploração

0.4%top 70% das CVEs

exploração observada

nãonenhuma fonte reporta

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Produtos afetados

gwin · WPAdverts – Classifieds Plugin

CVEs relacionadas — gwin WPAdverts – Classifieds Plugin

No mesmo produto, das mais perigosas para as menos.

CVE-2026-11801HIGHWPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST EndpointEPSS 1.6%CVE-2024-10890MEDIUMWPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2024-10108HIGHWPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add ShortcodeEPSS 0.4%

Referências