Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T09:16:42.183Z",
  "pubdate": "2026-10-12T09:16:42.183Z",
  "executiveSummary": "The Ad Inserter plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation.\nThis vulnerability, affecting versions from n/a through 2.8.18, allows an attacker to inject arbitrary malicious scripts into the application, which are subsequently stored and executed within the context of the victim's browser session.\nSuccessful exploitation can lead to unauthorized actions, session hijacking, defacement, or the theft of sensitive session cookies and data.\nThe risk is significant as it requires only that the payload be stored within the application, affecting any user—including administrators—who views the compromised page.\nAttackers do not necessarily need high-level privileges if they can trick an administrator into interacting with the malicious payload, or if they have existing access that allows for the submission of tainted data into the plugin's configuration or ad-management settings.",
  "technicalDetails": "The vulnerability resides in the way Ad Inserter handles data input that is subsequently rendered on web pages. The root cause is the failure to adequately sanitize, validate, or encode user-supplied content before outputting it within the HTML response. This deficiency in the input handling pipeline allows an attacker to inject arbitrary HTML, JavaScript, or other client-side executable code into the data storage mechanisms utilized by the plugin.\nThe exploitation flow typically begins with an attacker injecting a malicious script into a field handled by Ad Inserter. Because the input is not neutralized upon entry or during output, the browser treats the injected script as legitimate site content. When a target user, such as a site administrator or a visitor, views a page where the malicious content is rendered, the browser executes the script automatically.\nSince the script executes within the context of the vulnerable origin (the WordPress site), it gains access to the Document Object Model (DOM), browser storage, and cookies associated with that domain. This grants the attacker capabilities equivalent to the victim's permissions. If an administrator views the payload, the attacker could perform actions such as creating new administrative accounts, modifying plugin settings, or redirecting site traffic, effectively leading to a complete site compromise.\nThe vulnerability affects all versions of Ad Inserter from n/a through 2.8.18. It is a Stored XSS variant, meaning the payload persists in the database or server-side storage, ensuring that the malicious code triggers repeatedly for anyone viewing the affected content. The technical failure occurs during the rendering phase, where the plugin fails to utilize secure output encoding functions (e.g., esc_html(), esc_js()) to convert special characters into their HTML entity equivalents before embedding the content into the page generation workflow.\nThe scope of impact is broad, encompassing any functionality within the plugin that processes user input for display. Post-exploitation activities depend on the attacker's objectives but generally involve session token exfiltration to bypass authentication, executing unauthorized administrative operations, or performing 'phishing' attacks by modifying the rendered content of the host page to deceive users."
}