Ad Inserter, a WordPress plugin by Igor Funa, contains an improper neutralization of input during web page generation that enables stored cross‑site scripting. The flaw allows an attacker to inject malicious scripts that are executed in the browsers of all site visitors, potentially exposing session data, defacing content, or redirecting traffic. The weakness is categorized as CWE‑79, a classic input validation failure.

All installations of the Ad Inserter WordPress plugin up through version 2.8.18 are vulnerable, regardless of any custom configuration. No later version is affected.

The vulnerability scores a CVSS of 6.5, indicating moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting limited evidence of exploitation to date. Attackers would need the ability to write or modify content in the plugin’s settings—typically via an administrative WordPress account—to implant the malicious script. Once stored, the payload executes for every user who views pages that include the plugin's output.