CVE-2026-114709: WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ad Inserter pluginto a version that resolves this vulnerability.Fixed in 2.8.19
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges and must convince a user to interact with a crafted request or page. The network attack vector indicates exploitation can be initiated remotely.
What versions are affected?
Ad Inserter versions through 2.8.18 are affected. The available data does not identify a fixed version.
What is the potential impact?
Successful exploitation can execute reflected cross-site scripting in a victim's browser. The listed impact includes low confidentiality, integrity, and availability effects, with scope changed.