The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject unsanitized JavaScript into web pages generated by the Ad Inserter plugin. By placing malicious code in the plugin’s ad or code fields, an attacker could deface the site, steal cookies, hijack user sessions, or execute further attacks from compromised browsers. The weakness corresponds to CWE‑79, where input is not properly neutralized before rendering.

The flaw affects the WordPress Ad Inserter plugin from all versions up to and including 2.8.18. System administrators using any of these versions should be aware that any user with access to the plugin’s ad entry interface could embed harmful script in the site output.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog. The likely attack vector is the administrator or content‑manager interface of the plugin, where input is stored and later rendered without sanitation. An attacker with sufficient privileges to edit ad content could easily exploit the flaw. The risk therefore remains significant for sites that have the vulnerable plugin version installed and allow untrusted content insertion.