Improper neutralization of script‑related HTML tags allows basic XSS in the Strategy11 Team AWP Classifieds WordPress plugin. An attacker who can insert or edit content in a listing can place arbitrary JavaScript that executes in the context of any visitor to the site, potentially compromising session data and enabling further malicious actions.

WordPress sites running the AWP Classifieds plugin from its initial release up to and including version 4.4.3 made by Strategy11 Team are vulnerable. The vulnerability is present in all affected plugin instances regardless of host WordPress version.

The CVSS score of 5.3 indicates a moderate severity while the EPSS score of less than 1% shows that the likelihood of live exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack scenario is an attacker who can create or edit classified listings injecting malicious scripts, which then execute for other site visitors. Mitigation requires applying the vendor’s fix or otherwise disabling the plugin.