CVE-2026-124420: WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerability
Published Nov 13, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.
Affected Software
1 affected component
Themeisle Woody ad snippets<=2.7.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.11
Event History
Nov 13, 2026
CVE Published
via MITRE·03:08 PM
Data Sourced
via MITRE·03:08 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which plugin versions are affected?
Woody ad snippets versions through 2.7.10 are affected. The available data does not identify a fixed version.
2
What type of attack does this issue enable?
The issue enables reflected cross-site scripting through insufficient neutralization of input during web page generation. The provided data does not specify the vulnerable parameter, required privileges, or a mitigation other than updating once a fixed version is available.