The vulnerability is an unauthenticated cross‑site scripting flaw that lets attackers inject malicious scripts into the Ad Inserter plugin’s content fields. Because the flaw can be exploited without authentication, an attacker can cause a site visitor to run arbitrary JavaScript in the visitor’s browser, which can lead to cookie theft, session hijacking, defacement or the delivery of malware. This is a CWE‑79 type flaw.

The affected product is the Ad Inserter plugin developed by Spacetime. The vulnerability exists in all releases up to and including version 2.8.19. No other vendor or product versions are reported as affected.

The CVSS base score is 7.1, indicating a medium‑to‑high severity of the flaw. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog. Because it is unauthenticated, any user or attacker with access to the site’s public pages can deliver malicious input through the plugin’s interface, leading to client‑side code execution. No special prerequisites beyond exploiting the plugin’s input fields are required.