CVE-2026-114194: WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ad Inserter pluginto a version that resolves this vulnerability.Fixed in 2.8.19
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector is network-based, but the CVSS vector indicates the attacker needs low-level privileges and requires user interaction. This is not described as an unauthenticated, no-interaction attack.
What is the potential impact if exploitation succeeds?
The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed. The issue is a reflected XSS vulnerability, meaning attacker-controlled script could be executed in a user’s browser after that user interacts with a crafted request.
Which Ad Inserter versions are affected?
The affected range is stated as versions through 2.8.18. No fixed version is provided in the available data.