The Ad Inserter – Ad Manager & AdSense Ads plugin allows attackers who are not authenticated to inject arbitrary web scripts into pages that use iframe mode via unsanitized URL parameters. When a user is tricked into clicking a crafted link, the injected script runs with the privileges of the page, enabling session hijacking, defacement, or malware delivery. The vulnerability is caused by insufficient input filtering and failure to escape output, a classic reflected XSS flaw identified by CWE‑79.

Any WordPress site that installs the Ad Inserter plugin from the spacetime vendor, in versions up to and including 2.8.15. The flaw exists when the plugin’s iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on a page.

The CVSS score of 6.1 indicates a moderate severity vulnerability. No EPSS score is provided, and the issue is not listed in the CISA KEV catalog, suggesting limited documented exploitation. However, the attack path requires only that iframe mode be turned on, a non‑default yet commonly used configuration for AdSense and JavaScript‑based ads, making the vulnerability broadly exploitable with a simple crafted link.