Live › vulnerability › CVE-2026-105077
Ad Inserter, a WordPress plugin, has an unauthenticated cross-site scripting flaw in versions up to and including 2.8.19. An attacker can inject script that runs in a visitor's or administrator's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Any WordPress site running Ad Inserter (free) 2.8.19 or earlier. NVD/Patchstack do not say which input or page is vulnerable. It is unauthenticated but needs a user to interact (CVSS UI:R), so visitors and logged-in admins are the targets. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ad-inserter | wordpress-plugin | <= 2.8.19 | 2.8.20 |
Run wp plugin get ad-inserter --field=version or see Plugins in wp-admin; versions <= 2.8.19 are affected, 2.8.20 or later is the target.
Update Ad Inserter to 2.8.20 (current release; its changelog lists several XSS fixes, vendor does not map them to this CVE id).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105077")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.