CVE-2026-107864: WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ad Inserter pluginto a version that resolves this vulnerability.Fixed in 2.8.19
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges (PR:L) and user interaction (UI:R). It can be exploited remotely over the network (AV:N) with low attack complexity (AC:L).
What is the likely impact if exploitation succeeds?
Successful exploitation can result in stored cross-site scripting, with low impact to confidentiality, integrity, and availability. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component's security authority.
Which Ad Inserter versions are affected?
The issue affects Ad Inserter versions through 2.8.18. The available data does not identify a fixed version.