Stored Cross-Site Scripting Vulnerability in Quads Ads Manager for Google AdSense Plugin

CVE-2026-2595

What is CVE-2026-2595?

The Quads Ads Manager for Google AdSense plugin for WordPress contains a vulnerability that allows for stored cross-site scripting due to inadequate input sanitization and output escaping of multiple ad metadata parameters. This flaw enables authenticated users with Contributor-level access and higher to insert arbitrary web scripts into pages, which will then execute in the browser of any visitor who accesses the modified page. This poses a significant risk as it can compromise the security and integrity of affected websites.

References