The WP Google Ad Manager plugin contains a stored XSS flaw that allows an authenticated attacker, with administrator or higher privileges, to inject arbitrary JavaScript into the plugin’s admin settings. The vulnerable code is insufficiently sanitized and escaped, so the injected scripts are stored and subsequently executed each time a user views a page that loads the malicious admin entry. This could lead to session hijacking, defacement, or other client‑side compromise of any user who accesses the affected page (inferred).

All releases of the WP Google Ad Manager plugin (distributed by miles99) up to and including version 1.1.0 are affected. The vulnerability manifests only on multi‑site WordPress installations or on installations where the WordPress capability unfiltered_html has been disabled. Non‑multisite sites with unfiltered_html enabled are not impacted.

The flaw has a CVSS base score of 4.4 (moderate) and an EPSS score below 1 %, indicating low exploitation likelihood at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires administrator‑level authentication and works only when an administrator can create or edit the plugin’s settings; it does not allow arbitrary remote code execution outside the context of the affected plugin’s pages.