The Ad Inserter plugin allows reflected cross‑site scripting by failing to neutralize user‑supplied input during page generation. An attacker could inject malicious scripts that execute in the browser of any visitor who views a page containing the vulnerable ad code, potentially enabling cookie theft, session hijacking, or other client‑side attacks. The weakness is a classic reflected XSS flaw (CWE‑79).

WordPress sites running the Ad Inserter plugin version 2.8.18 or earlier. The vulnerability is present in all builds from the earliest release up to 2.8.18. Site administrators should verify the installed plugin version and update or remove the plugin accordingly.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, suggesting it is not a current priority exploit. Nonetheless, attackers can exploit the flaw by crafting a URL or injecting malicious content that triggers the ad insertion logic, causing the script to run in any visitor’s browser. The attack does not require privileged access and can be performed by any user capable of viewing affected content.