Reflected Cross-Site Scripting in Ad Inserter Plugin for WordPress
CVE-2026-19902

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Ad Inserter – Ad Manager & Adsense Ads
Vendor
CVE Published:
1 October 2026

What is CVE-2026-19902?

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is susceptible to Reflected Cross-Site Scripting via improper handling of the Referer header. This vulnerability exists in all versions up to and including 2.8.18 due to insufficient input sanitization and output escaping of the '{search-query}' dynamic tag. An attacker can exploit this flaw by embedding malicious scripts within a referrer URL, which, when parsed by the plugin, allows the execution of arbitrary JavaScript in the user’s browser. This poses a significant risk, as authenticated users, including administrators, may be targeted through crafted links that leverage affected ad blocks utilizing the vulnerable tag.

Affected Version(s)

Ad Inserter – Ad Manager & AdSense Ads 0 <= 2.8.18

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ad-inserter/ta...
https://plugins.trac.wordpress.org/browser/ad-inserter/ta...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuto Hyakumoto
.