CVE-2026-19902
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the Referer header. Insufficient input sanitization and output escaping on the '{search-query}' dynamic tag allow unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator. Exploitation requires an ad block with the '{search-query}' tag and automatic insertion enabled.
Risk Assessment
The risk involves execution of malicious scripts in the browser of any visitor, potentially leading to session theft, administrator account takeover, or content manipulation. The attack can be performed remotely without authentication.
Recommendation
Update the Ad Inserter plugin to the latest patched version. Additionally, consider removing the '{search-query}' tag from ad blocks if not essential.
Other vulnerabilities in Ad Inserter
See all- CVE-2026-118094Medium
The Ad Inserter plugin by Igor Funa (up to version 2.8.18) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-114709Medium
The Ad Inserter plugin (up to version 2.8.18) has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to reflect malicious script in the server response, which executes in the victim's browser.
- CVE-2026-97077High
Unauthenticated XSS attack in Ad Inserter plugin up to version 2.8.18. An attacker can inject malicious script without authentication.
- CVE-2026-105077High
The Ad Inserter plugin in versions up to 2.8.19 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.
- CVE-2026-114194Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS. This issue affects Ad Inserter: from n/a through 2.8.18.
- CVE-2026-89097Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.18 contains a sensitive information exposure vulnerability via ai_wp_footer_hook. This allows authenticated attackers with subscriber-level access and above to extract data such as the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.
- CVE-2026-107864Medium
Stored XSS vulnerability in the Ad Inserter plugin by Igor Funa. Improper input neutralization during page generation allows persistent script injection.
- CVE-2026-89427Medium
The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the 's' search parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires an ad block with {title} or {short-title} placeholder enabled on search pages.
- CVE-2026-81655High
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged-in user under a configuration its own settings allow, and does not filter the content saved there. This allows users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
- CVE-2026-11984Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.
Original NVD description (English source)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the '{search-query}' dynamic tag. When an ad block's code contains that tag, replace_ai_tags() reads $_SERVER['HTTP_REFERER'] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as '/google.com/' passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting 'q' (or 'p') value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the '{search-query}' tag with automatic insertion enabled — a documented plugin feature used as intended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS