Stored Cross-Site Scripting in WP Google Ad Manager Plugin for WordPress

CVE-2026-1399

What is CVE-2026-1399?

The WP Google Ad Manager Plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in admin settings. This flaw allows authenticated users with administrator-level permissions to inject malicious web scripts, which can execute when a user accesses the compromised page. The vulnerability primarily impacts multi-site installations and those where unfiltered_html is disabled, posing significant risks to data integrity and user security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References