CVE-2024-10108: WPAdverts WordPress Plugin XSS Vulnerability

CVE-2024-10108 Overview

CVE-2024-10108 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPAdverts – Classifieds Plugin for WordPress. The flaw affects all versions up to and including 2.1.6 and stems from insufficient input sanitization and output escaping in the plugin's adverts_add shortcode. Unauthenticated attackers can inject arbitrary JavaScript that executes in any user's browser when they visit an affected page. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript through the classifieds submission form, enabling session hijacking, credential theft, and administrative account compromise across affected WordPress sites.

Affected Products

WPAdverts – Classifieds Plugin for WordPress (all versions through 2.1.6)
WordPress sites exposing the adverts_add shortcode to unauthenticated users
Classified advertisement pages rendered by the vulnerable plugin

Discovery Timeline

2024-10-30 - CVE-2024-10108 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10108

Vulnerability Analysis

The vulnerability resides in the adverts_add shortcode supplied by the WPAdverts plugin. The shortcode renders the classified advertisement submission form and accepts user-supplied data from unauthenticated visitors. The plugin fails to properly sanitize input on receipt and does not escape the data when it is later rendered in the page. As a result, attacker-controlled payloads persist in the database and execute in the browser of every user who visits a page containing the injected content.

Because exploitation requires no authentication and no user interaction beyond visiting a page, the attack scales easily across exposed sites. The CVSS scope change reflects that an attacker can influence resources beyond the vulnerable component, such as authenticated administrator sessions.

Root Cause

The root cause is a dual failure in the plugin's data handling pipeline. Input arriving through the adverts_add shortcode is not sanitized using WordPress functions such as sanitize_text_field() or wp_kses(). The same data is later emitted into HTML output without escaping through esc_html(), esc_attr(), or equivalent context-aware functions. This combination allows raw <script> tags and event-handler attributes to be stored and executed.

Attack Vector

An unauthenticated attacker submits a classified advertisement containing JavaScript payloads through any page using the adverts_add shortcode. The payload is stored in the WordPress database and rendered in subsequent page loads. When a site administrator or visitor loads the affected listing, the script executes in their browser session, potentially exfiltrating cookies, performing administrative actions through CSRF, or redirecting users to attacker-controlled infrastructure.

No verified public exploit code is available. Technical analysis is documented in the Wordfence Vulnerability Analysis and the upstream fix is recorded in the WordPress Changeset Update.

Detection Methods for CVE-2024-10108

Indicators of Compromise

Database entries in the wp_posts or WPAdverts custom tables containing <script> tags, onerror=, onload=, or javascript: strings in advertisement fields
Unexpected outbound requests from administrator browsers to unknown domains after viewing classified listings
New or modified WordPress administrator accounts following visits to attacker-submitted advertisements
Anomalous POST requests to URLs containing the adverts_add shortcode endpoint from previously unseen IP addresses

Detection Strategies

Scan WordPress database tables for HTML/JavaScript patterns in fields populated by the adverts_add shortcode
Review web server access logs for POST submissions to ad creation endpoints containing encoded script payloads
Deploy a Web Application Firewall (WAF) rule set that flags XSS signatures targeting WordPress plugin shortcodes
Inspect the plugin version reported by the WordPress admin dashboard and confirm it is greater than 2.1.6

Monitoring Recommendations

Enable WordPress audit logging for post creation, user role changes, and plugin file modifications
Forward web server and WordPress logs to a centralized SIEM for correlation against XSS payload patterns
Alert on administrator session anomalies such as new IP addresses or unexpected privilege changes
Monitor for outbound DNS or HTTP traffic from server-rendered preview functionality to untrusted destinations

How to Mitigate CVE-2024-10108

Immediate Actions Required

Update the WPAdverts – Classifieds Plugin to a version newer than 2.1.6 on all WordPress installations
Audit existing classified advertisement entries for stored script payloads and remove malicious content
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected
Review user accounts and scheduled tasks for unauthorized additions created after the disclosure date

Patch Information

The vendor addressed the vulnerability in the plugin update tracked at the WordPress Changeset 3178088. Administrators should update via the WordPress plugin manager or download the latest release from the WPAdverts plugin page. Verify the installed version after updating and clear any object or page caches that may serve stale content.

Workarounds

Remove the adverts_add shortcode from public pages until the plugin is patched
Restrict access to advertisement submission pages using authentication or IP allow-listing at the web server level
Deploy a WAF rule blocking requests containing <script>, onerror=, and similar XSS payloads to plugin endpoints
Disable the WPAdverts plugin entirely if patching cannot be completed promptly

bash

# Example WP-CLI commands to check version and update the plugin
wp plugin get wpadverts --field=version
wp plugin update wpadverts
wp plugin get wpadverts --field=version