{"id":"CVE-2026-105077","kind":"vulnerability","aliases":["CVE-2026-105077"],"related":[],"title":"Ad Inserter WordPress plugin: unauthenticated XSS through 2.8.19","description":"Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.","summary":"Ad Inserter, a WordPress plugin, has an unauthenticated cross-site scripting flaw in versions up to and including 2.8.19. An attacker can inject script that runs in a visitor's or administrator's browser.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ad-inserter","fixed":["2.8.20"],"affected":"<= 2.8.19","ecosystem":"wordpress-plugin"}],"ecosystems":[],"tags":["ad-inserter","package","self-hosted","wordpress","wordpress-plugin","xss"],"not_affected_if":["managed-hosting-without-plugin","plugin-not-installed"],"how_to_check":"Run `wp plugin get ad-inserter --field=version` or see Plugins in wp-admin; versions <= 2.8.19 are affected, 2.8.20 or later is the target.","fix":"Update Ad Inserter to 2.8.20 (current release; its changelog lists several XSS fixes, vendor does not map them to this CVE id).","status":"open","published_at":"2026-10-30T19:17:58+00:00","first_seen_at":"2026-10-30T19:25:26+00:00","triaged_at":"2026-10-30T19:26:10+00:00","updated_at":"2026-10-30T19:32:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ad Inserter WordPress plugin: unauthenticated XSS through 2.8.19","impact":"medium","summary":"Ad Inserter, a WordPress plugin, has an unauthenticated cross-site scripting flaw in versions up to and including 2.8.19. An attacker can inject script that runs in a visitor's or administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ad-inserter","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitor or admin browsers on the site","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the vulnerable input path.","how_to_check":"- Check the installed Ad Inserter plugin version in the WordPress admin Plugins screen, or with `wp plugin get ad-inserter --field=version`\n- Compare the result against versions up to `2.8.19`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ad Inserter WordPress plugin at version 2.8.19 or earlier are in scope. The sources do not describe the exact injection point or whether a specific configuration is required, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":4068,"output_tokens":513,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the vulnerable input path.","search":"'-105077':11A,14A '-2026':10A,13A '2.8.19':8A,49B,73C 'ad':1A,16A,19B,30B,71C 'ad-insert':18B 'ad-inserter':15A 'administr':62B 'attack':51B 'browser':64B 'cross':39B,66C 'cross-sit':38B 'cve':9A,12A 'flaw':42B 'host':24B 'includ':48B 'inject':53B 'insert':2A,20B,31B,72C 'inserter':17A 'packag':21B 'plugin':4A,28B,34B 'run':56B 'script':41B,54B,68C 'self':23B 'self-host':22B 'site':40B,67C 'unauthent':5A,37B,65C 'version':44B,74C 'visitor':59B 'wordpress':3A,25B,27B,33B 'wordpress-plugin':26B 'xss':6A,29B,69C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running Ad Inserter (free) 2.8.19 or earlier. NVD/Patchstack do not say which input or page is vulnerable. It is unauthenticated but needs a user to interact (CVSS UI:R), so visitors and logged-in admins are the targets. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105077","severity":null,"published_at":"2026-10-30T19:17:58+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:26+00:00","fetched_at":"2026-10-30T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105077:1199","url":null,"severity":null,"published_at":"2026-10-30T19:32:24+00:00","modified_at":"2026-10-30T19:32:24+00:00","first_seen_at":"2026-10-30T19:32:24+00:00","fetched_at":"2026-10-30T19:32:24+00:00","note":"NVD gives no endpoint/param. wordpress.org changelog: 2.8.20 is current and fixes several XSS, but does not name this CVE; 2.8.19 changelog has one XSS fix (already shipped), so this one is presumably fixed in 2.8.20 (inference, not verified). Sibling CVEs (<=2.8.18) were fixed in 2.8.19. No exploitation or PoC found."}],"documents":[{"id":25526,"url":"https://wordpress.org/plugins/ad-inserter/","title":"Ad Inserter changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":25527,"url":"https://patchstack.com/database/wordpress/plugin/ad-inserter/vulnerabilities","title":"Patchstack: Ad Inserter vulnerability history","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}