CVE-2026-9280

Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode

View on CVE.org
Published Jun 6, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Description
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.

Analysis

AI-generated

Technical impact

The Ad Inserter – Ad Manager & AdSense Ads plugin allows attackers who are not authenticated to inject arbitrary web scripts into pages that use iframe mode via unsanitized URL parameters. When a user is tricked into clicking a crafted link, the injected script runs with the privileges of the page, enabling session hijacking, defacement, or malware delivery. The vulnerability is caused by insufficient input filtering and failure to escape output, a classic reflected XSS flaw identified by CWE‑79.

Affected Systems

Any WordPress site that installs the Ad Inserter plugin from the spacetime vendor, in versions up to and including 2.8.15. The flaw exists when the plugin’s iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on a page.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate severity vulnerability. No EPSS score is provided, and the issue is not listed in the CISA KEV catalog, suggesting limited documented exploitation. However, the attack path requires only that iframe mode be turned on, a non‑default yet commonly used configuration for AdSense and JavaScript‑based ads, making the vulnerability broadly exploitable with a simple crafted link.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Ad Inserter plugin to the latest available version (post‑2.8.15) which removes the unsafe code paths for iframe mode.
  • If an upgrade is not immediately possible, disable iframe mode (AI_OPTION_IFRAME) or remove ad blocks that use this mode from the affected pages.
  • Use a web application firewall or content‑security‑policy headers to block script injection attempts and ensure that all URL parameters are validated or stripped before rendering.

Generated by OpenCVE AI on June 6, 2026 at 04:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Spacetime
Spacetime ad Inserter – Ad Manager & Adsense Ads
Wordpress
Wordpress wordpress
Vendors & Products Spacetime
Spacetime ad Inserter – Ad Manager & Adsense Ads
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.
Title Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Jun 6, 2026, 11:43 AM
Reserved
May 22, 2026, 1:58 PM

View source JSON

Updated
Jun 6, 2026, 11:43 AM

JSON

Status
Deferred
Published
Jun 6, 2026, 4:17 AM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

No data.

Updated
Jun 7, 2026, 11:15 AM

JSON