Wpadverts Vulnerabilities

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site confi...

CVSS:

7.5

Affected:

up to 2.3.2

Fixed in:

2.3.3

Disclosed:

Aug 17, 2026

CVE-2026-11801 on NVD →

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wheneve...

CVSS:

7.2

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Jul 1, 2026

CVE-2026-57366 on NVD →

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.3.0

Fixed in:

2.3.1

Disclosed:

Apr 22, 2026

CVE-2026-40782 on NVD →

[en] Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: from n/a through <= 2.2.11.

Affected:

up to 2.2.11

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-27092 on NVD →

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.0. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.3.0

Fixed in:

2.3.1

Disclosed:

Jan 7, 2026

CVE-2026-27092 on NVD →

The WPAdverts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 2.2.5

Fixed in:

2.2.6

Disclosed:

Jul 16, 2025

CVE-2025-54024 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows DOM-Based XSS. This issue affects WPAdverts: from n/a through 2.2.5.

Affected:

up to 2.2.6

Fixed in:

2.2.6

Disclosed:

Jul 16, 2025

CVE-2025-54024 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows DOM-Based XSS. This issue affects WPAdverts: from n/a through 2.2.4.

Affected:

up to 2.2.5

Fixed in:

2.2.5

Disclosed:

Jun 17, 2025

CVE-2025-49878 on NVD →

The WPAdverts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 2.2.4

Fixed in:

2.2.5

Disclosed:

Jun 12, 2025

CVE-2025-49878 on NVD →

The WPAdverts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 2.2.3

Fixed in:

2.2.4

Disclosed:

May 19, 2025

CVE-2025-48269 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows DOM-Based XSS. This issue affects WPAdverts: from n/a through 2.2.3.

Affected:

up to 2.2.4

Fixed in:

2.2.4

Disclosed:

May 19, 2025

CVE-2025-48269 on NVD →

The WPAdverts plugin for WordPress is vulnerable to Local File Inclusion via several render() functions in versions up to, and including, 2.2.2. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of an...

CVSS:

8.8

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

May 7, 2025

CVE-2025-47440 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Greg Winiarski WPAdverts allows PHP Local File Inclusion. This issue affects WPAdverts: from n/a through 2.2.2.

Affected:

up to 2.2.3

Fixed in:

2.2.3

Disclosed:

May 7, 2025

CVE-2025-47440 on NVD →

The WPAdverts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 2.2.1

Fixed in:

2.2.2

Disclosed:

Apr 16, 2025

CVE-2025-39576 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows Stored XSS. This issue affects WPAdverts: from n/a through 2.2.1.

Affected:

up to 2.2.2

Fixed in:

2.2.2

Disclosed:

Apr 16, 2025

CVE-2025-39576 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Greg Winiarski WPAdverts – Classifieds Plugin allows Cross Site Request Forgery.This issue affects WPAdverts – Classifieds Plugin: from n/a through 2.1.2.

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Jan 2, 2025

CVE-2024-37238 on NVD →

[en] The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary we...

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Nov 21, 2024

CVE-2024-10890 on NVD →

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scr...

CVSS:

6.1

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Nov 20, 2024

CVE-2024-10890 on NVD →

[en] The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Oct 30, 2024

CVE-2024-10108 on NVD →

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

7.2

Affected:

up to 2.1.6

Fixed in:

2.1.7

Disclosed:

Oct 29, 2024

CVE-2024-10108 on NVD →

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to modify admin settings via a forged request granted they can trick a s...

CVSS:

4.3

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Jun 21, 2024

CVE-2024-37238 on NVD →