WPAdverts plugin has an improper neutralization of input during web page generation that allows reflected cross‑site scripting. An attacker can embed malicious script in an input that the plugin returns to the page, which will execute in the victim’s browser when the page is loaded.

WordPress sites using Greg Winiarski WPAdverts plugin versions 2.3.4 and earlier are affected; the flaw applies to all releases from the earliest available version up to and including 2.3.4.

The CVSS score is 7.1, indicating medium‑to‑high severity. EPSS is unavailable and the vulnerability is not listed in CISA KEV. The likely attack vector is a crafted link or form input that the victim interacts with, which causes the malicious script to be rendered and executed in the victim’s browser.