CVE-2026-118094: WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs at least low-level privileges and user interaction to exploit the stored XSS vulnerability. The attack can be performed over the network with low attack complexity.

Q: What impact can successful exploitation have?

The vulnerability can affect confidentiality, integrity, and availability at a low level, and its scope may extend beyond the vulnerable component.

Q: Which plugin versions are affected?

Ad Inserter versions through 2.8.18 are affected. The available data does not identify a fixed version.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Ad Inserter plugin to a version that resolves this vulnerability.
Fixed in 2.8.19

Event History

Oct 29, 2026

CVE Published

via MITRE·12:59 PM

Data Sourced

via MITRE·12:59 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs at least low-level privileges and user interaction to exploit the stored XSS vulnerability. The attack can be performed over the network with low attack complexity.

What impact can successful exploitation have?

The vulnerability can affect confidentiality, integrity, and availability at a low level, and its scope may extend beyond the vulnerable component.

Which plugin versions are affected?

Ad Inserter versions through 2.8.18 are affected. The available data does not identify a fixed version.

CVE-2026-118094: WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which plugin versions are affected?