{"id":"CVE-2026-124262","kind":"vulnerability","aliases":["CVE-2026-124262"],"related":[],"title":"Ad Inserter WordPress plugin: script injection flaw lets attackers run code","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.","summary":"Ad Inserter, a WordPress plugin by Igor Funa, does not neutralize script-related HTML tags on a web page, which is a cross-site scripting flaw. An attacker who can get input into a page may run scripts in other visitors' browsers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ad-inserter","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Ad Inserter version in the WordPress admin plugin list or the `ad-inserter` plugin header; the sources say it affects versions through `2.8.19`.","fix":null,"status":"open","published_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:40+00:00","updated_at":"2026-11-11T13:29:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ad Inserter WordPress plugin: script injection flaw lets attackers run code","impact":"medium","summary":"Ad Inserter, a WordPress plugin by Igor Funa, does not neutralize script-related HTML tags on a web page, which is a cross-site scripting flaw. An attacker who can get input into a page may run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ad-inserter"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and any required privileges from the NVD entry or the plugin's changelog; the sources give only the affected range.","how_to_check":"- Check the installed Ad Inserter version in the WordPress admin plugin list or the `ad-inserter` plugin header; the sources say it affects versions through `2.8.19`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ad Inserter WordPress plugin version 2.8.19 or earlier are in scope according to the advisory. The sources do not say which settings or roles make a site reachable, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4562,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124262':14A,17A '-2026':13A,16A '2.8.19':100C 'ad':1A,19B,23B,85C,88C,95C 'ad-insert':18B,87C 'affect':94C 'allow':90C 'attack':9A,52B 'basic':79C 'browser':66B 'code':11A,91C 'cross':47B 'cross-sit':46B 'cve':12A,15A 'flaw':7A,50B 'funa':30B,84C 'get':55B 'html':37B,73C 'igor':29B,83C 'improp':67C 'inject':6A 'injection.this':92C 'input':56B 'insert':2A,20B,24B,86C,89C,96C 'issu':93C 'let':8A 'may':60B 'n/a':98C 'neutral':33B,68C 'packag':21B 'page':42B,59B,78C 'plugin':4A,27B 'relat':36B,72C 'run':10A,61B 'script':5A,35B,49B,62B,71C 'script-rel':34B,70C 'site':48B 'tag':38B,74C 'visitor':65B 'vulner':81C 'web':41B,77C 'wordpress':3A,22B,26B 'xss':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ad Inserter WordPress plugin version 2.8.19 or earlier are in scope according to the advisory. The sources do not say which settings or roles make a site reachable, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adinserter","medium","package","wordpress"],"campaign_type":null,"search_a":"'-124262':14A,17A '-2026':13A,16A 'ad':1A 'attack':9A 'code':11A 'cve':12A,15A 'flaw':7A 'inject':6A 'insert':2A 'let':8A 'plugin':4A 'run':10A 'script':5A 'wordpress':3A","search_b":"'ad':19B,23B 'ad-insert':18B 'attack':52B 'browser':66B 'cross':47B 'cross-sit':46B 'flaw':50B 'funa':30B 'get':55B 'html':37B 'igor':29B 'input':56B 'insert':20B,24B 'may':60B 'neutral':33B 'packag':21B 'page':42B,59B 'plugin':27B 'relat':36B 'run':61B 'script':35B,49B,62B 'script-rel':34B 'site':48B 'tag':38B 'visitor':65B 'web':41B 'wordpress':22B,26B","search_c":"'2.8.19':100C 'ad':85C,88C,95C 'ad-insert':87C 'affect':94C 'allow':90C 'basic':79C 'code':91C 'funa':84C 'html':73C 'igor':83C 'improp':67C 'injection.this':92C 'insert':86C,89C,96C 'issu':93C 'n/a':98C 'neutral':68C 'page':78C 'relat':72C 'script':71C 'script-rel':70C 'tag':74C 'vulner':81C 'web':77C 'xss':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124262","severity":null,"published_at":"2026-11-11T13:17:18+00:00","modified_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}