Stored Cross-Site Scripting in Advanced Classifieds & Directory Pro Plugin for WordPress

CVE-2026-93883

What is CVE-2026-93883?

The Advanced Classifieds & Directory Pro plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping implemented in the 'phone' parameter. Authenticated attackers with custom-level access can inject malicious web scripts into pages, which will execute when users interact with the infected content. This issue is only exploitable under specific conditions, where the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is utilized on a sidebar that appears on single listing pages, both settings being non-default configurations.

References