Reflected XSS Vulnerability Affects Ad Inserter

CVE-2024-49248

What is CVE-2024-49248?

The Ad Inserter plugin by Igor Funa is exposed to a significant vulnerability due to improper neutralization of input during web page generation. This flaw allows for reflected Cross-Site Scripting (XSS) attacks, potentially enabling attackers to inject malicious scripts into web pages rendered for users. As a result, users of affected versions, specifically those prior to 2.7.37, could inadvertently expose themselves to security breaches, including the unauthorized execution of scripts. Immediate action is advised to secure affected instances of Ad Inserter and safeguard user interactions.

References