CVE-2026-89427: Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has configured at least one Ad Inserter block using the {title} or {short-title} placeholder with that block enabled for search pages, which is a standard, documented plugin feature.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to this issue?
A site is exposed only if it runs Ad Inserter version 2.8.18 or earlier and has at least one enabled block configured to appear on search pages that uses the {title} or {short-title} placeholder. This requires an administrator configuration; it is not indicated as affecting every default installation.
What does an attacker need to exploit it?
The attacker does not need authentication, but must persuade a user to perform an action such as clicking a crafted link. The malicious script is injected through the search parameter and executes in the affected site's context when the vulnerable search-page block configuration is present.
How can I check whether my configuration is affected?
Review enabled Ad Inserter blocks that are configured for search pages. Check whether any of those blocks include the {title} or {short-title} placeholder and whether the installed plugin version is 2.8.18 or earlier.
What can be done if updating is not immediately possible?
Disable affected blocks on search pages or remove the {title} and {short-title} placeholders from those blocks. Either change removes the stated configuration condition required for exploitation.