The WPAdverts plugin contains an improper neutralization of input during web page generation, allowing attackers to store malicious scripts that will be executed when users view affected pages. This stored XSS flaw can lead to session hijacking, cookie theft, or drive‑by downloads if an attacker succeeds in delivering payload to legitimate users. The fundamental weakness is a failure to escape user‑supplied data when rendering pages, identified as CWE-79.

The vulnerability is present in the Greg Winiarski WPAdverts plugin for WordPress, affecting all published versions up to and including 2.3.4. Sites that have not upgraded beyond 2.3.4 are susceptible to exploitation.

The CVSS score of 7.1 indicates high severity, while the EPSS score is currently unavailable and the vulnerability is not listed in CISA’s KEV database. Attackers can exploit the flaw by submitting malicious content via the plugin’s input fields, which is then stored and rendered to visitors. As the flaw is stored XSS, any user who views the affected content will have the injected script executed in their browser, potentially compromising user sessions or delivering phishing content.