The Ad Inserter – Ad Manager & AdSense Ads plugin contains a reflected cross‑site scripting flaw that arises from the 's' search parameter. The code fails to sanitize this input and does not escape the output, allowing an unauthenticated user to inject arbitrary JavaScript that will run in the browser when the victim visits a crafted URL.

Spacetime’s Ad Inserter plugin is vulnerable in all releases up to and including version 2.8.18. Exploitation requires that a site administrator has configured at least one Ad Inserter block that uses the {title} or {short‑title} placeholder and enabled that block for search‑page requests, which is a documented, standard configuration option.

The vulnerability is rated as a moderate risk with a CVSS score of 6.1 and has no EPSS score reported. It is not listed in the CISA KEV catalog. An attacker would need to construct a malicious link containing a crafted search term and persuade a user to click it, which is a common method for executing reflected XSS payloads. Successful exploitation would result in arbitrary script execution in the victim’s browser within the context of the site.