CVE-2026-97264: WPAdverts Reflected XSS Vulnerability

CVE-2026-97264 Overview

CVE-2026-97264 is a reflected cross-site scripting (XSS) vulnerability in the WPAdverts plugin for WordPress, developed by Greg Winiarski. The flaw affects all plugin versions up to and including 2.3.4 and stems from improper neutralization of user input during web page generation [CWE-79]. An unauthenticated attacker can craft a malicious URL that, when visited by a target user, executes arbitrary JavaScript in the browser context of the victim. The scope change in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, including authenticated administrator sessions.

Critical Impact
Attackers can hijack administrator sessions, steal authentication cookies, or perform actions on behalf of victims by delivering a crafted link that triggers script execution in the WordPress site context.

Affected Products

WPAdverts plugin for WordPress, versions up to and including 2.3.4
WordPress sites running Greg Winiarski's WPAdverts classified ads plugin
All deployments of WPAdverts without the vendor security patch applied

Discovery Timeline

2026-10-10 - CVE-2026-97264 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97264

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the WPAdverts WordPress plugin. User-supplied input is echoed back into the rendered HTML without proper encoding or sanitization. When a victim clicks a crafted link, the plugin returns a response containing attacker-controlled JavaScript, which the browser executes within the trust context of the WordPress site.

The CVSS vector reflects a changed scope (S:C), meaning the injected payload executes beyond the vulnerable component boundary. Required user interaction (UI:R) means successful exploitation depends on the victim loading the crafted URL, typically through phishing or embedded links. The EPSS probability is 0.146%.

Root Cause

The root cause is missing output encoding on request parameters processed by the WPAdverts plugin before they are reflected into generated HTML. The plugin accepts input through HTTP request parameters and renders it directly into page markup without applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). This allows an attacker to inject HTML and JavaScript constructs that break out of the intended data context.

Attack Vector

Exploitation requires an attacker to craft a URL containing a JavaScript payload in a vulnerable request parameter and deliver it to a target. The attack vector is network-based (AV:N) and requires no authentication (PR:N). When the victim loads the URL, the payload executes in their browser with the privileges of their current WordPress session. Attackers commonly use this vector to steal session cookies, perform forced actions through CSRF-style requests, or redirect users to malicious infrastructure.

No verified public exploit code is available at this time. Technical details are referenced in the Patchstack WPAdverts XSS Vulnerability advisory.

Detection Methods for CVE-2026-97264

Indicators of Compromise

HTTP request logs containing URL parameters with encoded <script>, javascript:, or event handler strings such as onerror= and onload= targeting WPAdverts endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains following an admin session
Creation of new WordPress administrator accounts or unauthorized plugin installations without corresponding admin activity

Detection Strategies

Inspect web server access logs for requests to WPAdverts routes that include suspicious query strings or URL-encoded script fragments
Deploy a web application firewall rule set that flags reflected XSS patterns against WordPress plugin endpoints
Correlate referer headers and session activity to identify administrators who followed external links before privileged actions

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions, plugin changes, and user role modifications
Monitor for Content Security Policy (CSP) violation reports originating from WPAdverts pages
Track EPSS score changes and vendor advisories to detect active exploitation trends against this CVE

How to Mitigate CVE-2026-97264

Immediate Actions Required

Identify all WordPress sites running WPAdverts version 2.3.4 or earlier and prioritize them for patching
Review Patchstack and the WordPress plugin repository for a fixed release and upgrade immediately
Advise administrators to avoid clicking untrusted links while authenticated to the WordPress admin interface

Patch Information

Refer to the Patchstack WPAdverts XSS Vulnerability advisory for the current patch status. Upgrade WPAdverts to a version later than 2.3.4 once the vendor publishes a fixed release.

Workarounds

Deactivate the WPAdverts plugin until a patched version is installed if the site can tolerate loss of classified ads functionality
Deploy a web application firewall with virtual patching rules that block reflected XSS payloads targeting WPAdverts request parameters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Example WAF rule concept blocking script tags in WPAdverts query strings
SecRule REQUEST_URI "@contains /wp-content/plugins/wpadverts" \
  "chain,deny,status:403,id:1026972640,msg:'Blocked WPAdverts XSS attempt'"
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni"