{"id":"CVE-2026-118094","kind":"vulnerability","aliases":["CVE-2026-118094"],"related":[],"title":"Ad Inserter WordPress plugin: stored XSS through 2.8.18","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.","summary":"Ad Inserter, a WordPress plugin by Igor Funa, fails to neutralize input when generating pages, letting stored cross-site scripting payloads persist. An attacker can run scripts in the browsers of visitors or administrators who view the affected content.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ad-inserter","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Ad Inserter plugin version in the WordPress admin under Plugins; versions up to and including `2.8.18` are listed as affected.","fix":"- Ad Inserter: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-10-29T13:17:08+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:43+00:00","updated_at":"2026-10-29T13:25:43+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T13:25:43Z","model":"claude-haiku-5-5","output":{"fix":"- Ad Inserter: unknown (sources do not name a fixed version)","reach":"internet","title":"Ad Inserter WordPress plugin: stored XSS through 2.8.18","impact":"medium","summary":"Ad Inserter, a WordPress plugin by Igor Funa, fails to neutralize input when generating pages, letting stored cross-site scripting payloads persist. An attacker can run scripts in the browsers of visitors or administrators who view the affected content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ad-inserter","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' or admins' browsers","analyst_note":"Confirm the fixed version and required privileges from the vendor or WordPress plugin advisory page; NVD entry gives only the affected range.","how_to_check":"- Check the installed Ad Inserter plugin version in the WordPress admin under Plugins; versions up to and including `2.8.18` are listed as affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ad Inserter plugin for WordPress at version 2.8.18 or earlier. The sources do not say which settings or roles are needed to trigger the stored script, so treat any site with the plugin as potentially exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4125,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118094':11A,14A '-2026':10A,13A '2.8.18':8A,94C 'ad':1A,16B,23B,79C,82C,89C 'ad-insert':15B,81C 'administr':57B 'affect':61B,88C 'allow':84C 'attack':47B 'browser':53B 'content':62B 'cross':41B,72C 'cross-sit':40B,71C 'cve':9A,12A 'fail':31B 'funa':30B,78C 'generat':36B,70C 'host':21B 'igor':29B,77C 'improp':63C 'input':34B,66C 'insert':2A,17B,24B,80C,83C,90C 'issu':87C 'let':38B 'n/a':92C 'neutral':33B,64C 'packag':18B 'page':37B,69C 'payload':44B 'persist':45B 'plugin':4A,27B 'run':49B 'script':43B,50B,74C 'self':20B 'self-host':19B 'site':42B,73C 'store':5A,39B,85C 'view':59B 'visitor':55B 'vulner':75C 'web':68C 'wordpress':3A,22B,26B 'xss':6A 'xss.this':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ad Inserter plugin for WordPress at version 2.8.18 or earlier. The sources do not say which settings or roles are needed to trigger the stored script, so treat any site with the plugin as potentially exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118094","severity":null,"published_at":"2026-10-29T13:17:08+00:00","modified_at":"2026-10-29T13:17:08+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}