A stored cross‑site scripting vulnerability exists in the WPeka WP AdCenter WordPress plugin for versions up to and including 2.5.8. Improper neutralization of input during web page generation allows an attacker to store malicious JavaScript that executes whenever a page containing the plugin’s output is viewed, enabling session theft, defacement, or malicious redirection.

WordPress sites that have the WP AdCenter plugin by WPeka installed in any version 2.5.8 or earlier are affected. No other versions are listed as vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attack requires that the attacker can submit or edit ad content through the plugin interface. The description does not specify the exact access level required, but it is inferred that authentication with sufficient privileges is necessary. Once inserted, the XSS payload will run for any user who loads the affected page, giving the attacker broad impact in a compromised site.