WPFactory Adverts vulnerabilities

Latest WPFactory Adverts CVEs

Newest publication first

1. CVE-2025-57911 WordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-22

   Medium·CVSS 6.5 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Adverts adverts-click-tracker allows DOM-Based XSS.This issue affects Adverts: from n/a through <= 1.4.

2. CVE-2025-31848 WordPress WordPress Adverts Plugin plugin <= 1.4 - Broken Access Control vulnerability

   Published 2025-04-01

   Medium·CVSS 5.3 EPSS 0.46%

   Missing Authorization vulnerability in WPFactory Adverts adverts-click-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Adverts: from n/a through <= 1.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.