CVE-2024-10890: WPAdverts Classifieds Plugin XSS Vulnerability

CVE-2024-10890 Overview

CVE-2024-10890 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WPAdverts – Classifieds Plugin for WordPress. The flaw exists in all versions up to and including 2.1.7. The plugin uses add_query_arg and remove_query_arg without appropriate escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts. Exploitation requires user interaction, such as clicking a crafted link. Successful attacks execute script content in the victim's browser session under the site's origin. The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser through a crafted URL, enabling session theft, credential harvesting, or unauthorized administrative actions on affected WordPress sites.

Affected Products

WPAdverts – Classifieds Plugin for WordPress, all versions ≤ 2.1.7
WordPress sites hosting the vulnerable plugin
includes/shortcodes.php component within the plugin

Discovery Timeline

2024-11-21 - CVE-2024-10890 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10890

Vulnerability Analysis

The vulnerability resides in the plugin's use of WordPress core helper functions add_query_arg() and remove_query_arg() within includes/shortcodes.php. These functions preserve existing query string parameters when constructing URLs. When the resulting URL is echoed back into HTML output without escaping, attacker-controlled query parameters flow directly into the rendered page. This is a classic reflected XSS pattern documented by the WordPress security team since 2016.

The attack is unauthenticated and requires only that a target user click a crafted link pointing to a page rendered by the vulnerable plugin. Because the scope changes across security boundaries, injected script executes within the WordPress site's origin. Attackers can hijack authenticated sessions, perform administrative actions on behalf of logged-in editors or administrators, or redirect visitors to attacker-controlled infrastructure.

Root Cause

The root cause is missing output escaping around URLs generated by add_query_arg and remove_query_arg. WordPress explicitly warns developers that these functions do not sanitize input and their return values must be passed through esc_url() before use in HTML attributes. The plugin failed to apply this escaping on line 545 of includes/shortcodes.php in version 2.1.7.

Attack Vector

An attacker crafts a URL to a page containing the vulnerable WPAdverts shortcode. The URL includes malicious query string parameters containing JavaScript payload fragments and HTML break-out sequences. When the victim visits the link, the plugin reflects the tainted parameters back into an unescaped href attribute or similar sink, executing the payload in the victim's browser context. No authentication is required by the attacker; only a successful social engineering step against a logged-in user is needed for maximum impact.

Technical details and the patched code diff are available in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-10890

Indicators of Compromise

HTTP requests to WordPress pages hosting WPAdverts shortcodes containing suspicious query parameters such as ", <script, onerror=, or javascript: sequences
Web server access logs showing referrers or query strings with URL-encoded HTML entities like %3Cscript%3E targeting classifieds pages
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after clicking external links
User reports of unexpected redirects or JavaScript prompts on the classifieds section of the site

Detection Strategies

Inspect web application firewall logs for reflected XSS patterns against URLs containing WPAdverts shortcodes
Query the WordPress plugin inventory to identify installations running WPAdverts version ≤ 2.1.7
Correlate administrator session activity with anomalous query string reflection events in access logs

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress hosts and forward to a centralized analytics platform for query-string inspection
Monitor administrator and editor accounts for unexpected privileged actions performed outside normal patterns
Alert on any newly created WordPress users, plugin installations, or theme edits following suspicious URL access

How to Mitigate CVE-2024-10890

Immediate Actions Required

Update WPAdverts – Classifieds Plugin to a version later than 2.1.7 that includes the fix from changeset 3192192
Audit WordPress administrator and editor accounts for indicators of session compromise and rotate credentials if suspicious activity is found
Instruct privileged users to avoid clicking unsolicited links pointing to the WordPress site's classifieds pages

Patch Information

The vendor addressed the vulnerability in the plugin's trunk via changeset 3192192, which applies proper URL escaping around the vulnerable add_query_arg and remove_query_arg calls in includes/shortcodes.php. Site operators should upgrade to the first released version containing this changeset. Reference the vulnerable source code to confirm the affected line is remediated.

Workarounds

Deploy a web application firewall rule that blocks requests to WPAdverts-rendered pages containing <, >, or script tokens in query parameters
Temporarily disable the WPAdverts plugin on production sites until the patched version can be deployed
Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of reflected XSS payloads

bash

# Configuration example: WP-CLI commands to check version and update
wp plugin get wpadverts --field=version
wp plugin update wpadverts
wp plugin status wpadverts