WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100178 · Microsoft / collected KEV context

cve-program · CVE-2026-100178

• https://www.wordfence.com/threat-intel/vulnerabilities/id/84d362e2-a0ba-48e6-b4f5-46e080a7eee1?source=cve
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions-blocks.php#L483
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions-blocks.php#L467
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/blocks/list/templates/list-item.php#L36
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions.php#L1878
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions.php#L1961
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/defaults.php#L150
• https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/blocks/publish/class-publish-engine.php#L422
• https://plugins.trac.wordpress.org/browser/wpadverts/trunk/readme.txt?rev=3732587
• https://plugins.trac.wordpress.org/changeset/3732587/wpadverts/trunk/includes/functions-blocks.php

No related operational record is retained in the current change model.