Live › vulnerability › CVE-2026-118094
Ad Inserter, a WordPress plugin by Igor Funa, fails to neutralize input when generating pages, letting stored cross-site scripting payloads persist. An attacker can run scripts in the browsers of visitors or administrators who view the affected content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Sites running the Ad Inserter plugin for WordPress at version 2.8.18 or earlier. The sources do not say which settings or roles are needed to trigger the stored script, so treat any site with the plugin as potentially exposed.
No product ranges from the sources yet.
2.8.18 are listed as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
This page as .md · .json · in your agent: get_signal("CVE-2026-118094")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.