Live › vulnerability › CVE-2026-114194
Go to dashboardAd Inserter, a WordPress plugin by Igor Funa, does not neutralize input in a web page it generates, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser by getting them to open a crafted link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 10:47 UTC. All times on this page are UTC.
Sites running Ad Inserter version 2.8.18 or earlier. The sources do not say which page or parameter is involved or whether logged-in users are targeted, so the exposure of a given site is unknown. Sites without the plugin are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Update Ad Inserter to a version later than 2.8.18, the last version the sources list as affected.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
This page as .md · .json · in your agent: get_signal("CVE-2026-114194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.