The Address Bar Ads plugin for WordPress is vulnerable to reflected cross‑site scripting due to inadequate input validation and output sanitization. When an attacker crafts a URL containing malicious JavaScript in the path, a browser will echo that payload back into the page without proper escaping. Executed scripts can compromise the confidentiality of user data, steal cookies, or perform actions on behalf of the victim. Because the vulnerability is reflected, it does not require pre‑existing data in the database, making it exploitable in real‑time interactions.

Sivenso’s Address Bar Ads plugin, versions 1.0.0 and earlier, installed on WordPress sites. No other products are listed, so only environments running this specific plugin are impacted.

The CVSS base score of 6.1 indicates a medium severity. The EPSS score is reported as <1%, showing a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by having a victim click on a malicious link that embeds script code in the URL path—an unauthenticated, remote attack that requires no additional privileges.