Technical impact
The Ad Inserter plugin does not properly neutralize input when generating web page content, allowing attackers to inject arbitrary JavaScript in a reflected form. This flaw, classified as CWE‑79, can enable session hijacking, defacement, or phishing attacks when users view affected pages. The CVSS score of 6.5 indicates moderate severity.
Affected Systems
Any WordPress site that has the Igor Funa Ad Inserter plugin installed up through version 2.8.18 is impacted. The vulnerability applies to all releases from the earliest available version up to and including 2.8.18. No specific operating system is required; the flaw exists within the WordPress plugin logic.
Risk and Exploitability
With a CVSS score of 6.5 and no EPSS data, the risk is considered moderate. The vulnerability is not listed in the CISA KEV catalog. Exploitation is inferred to involve an attacker crafting a malicious URL or inserting script‑containing ad code that is reflected when the page is rendered. Because no formal workaround is provided, removal or patching of the plugin is required to eliminate the attack vector.
