{"id":"CVE-2026-124420","kind":"vulnerability","aliases":["CVE-2026-124420"],"related":[],"title":"Woody ad snippets WordPress plugin: reflected XSS through 2.7.10","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.","summary":"Woody ad snippets, a WordPress plugin by Themeisle, has a reflected cross-site scripting flaw in its insert-php feature. An attacker can get malicious script to run in a visitor's browser through a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Woody ad snippets","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","themeisle","woody-ad-snippets","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Woody ad snippets plugin is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version against `2.7.10`, which the advisory lists as affected","fix":"- Woody ad snippets: unknown; the sources do not name a fixed version","status":"open","published_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:48:36+00:00","updated_at":"2026-11-13T15:48:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T15:48:36Z","model":"claude-haiku-5-5","output":{"fix":"- Woody ad snippets: unknown; the sources do not name a fixed version","reach":"internet","title":"Woody ad snippets WordPress plugin: reflected XSS through 2.7.10","impact":"medium","summary":"Woody ad snippets, a WordPress plugin by Themeisle, has a reflected cross-site scripting flaw in its insert-php feature. An attacker can get malicious script to run in a visitor's browser through a crafted link.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woody-ad-snippets","themeisle"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and whether insert-php must be enabled, from the Wordfence or WPScan entry for CVE-2026-124420.","how_to_check":"- Check whether the Woody ad snippets plugin is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version against `2.7.10`, which the advisory lists as affected\n- unknown for a fixed version","plain_action":"","product_name":"Woody ad snippets","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Woody ad snippets WordPress plugin at version 2.7.10 or earlier are in scope. The sources do not say whether the insert-php feature must be enabled for the flaw to be reachable.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4548,"output_tokens":582,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124420':12A,15A '-2026':11A,14A '2.7.10':9A,97C 'ad':2A,17A,23B,27B,81C,92C 'affect':90C 'allow':86C 'attack':49B 'browser':60B 'craft':63B 'cross':38B,74C 'cross-sit':37B,73C 'cve':10A,13A 'featur':47B 'flaw':41B 'generat':72C 'get':51B 'improp':65C 'input':68C 'insert':45B,84C 'insert-php':44B,83C 'issu':89C 'link':64B 'malici':52B 'n/a':95C 'neutral':66C 'page':71C 'php':46B,85C 'plugin':5A,31B 'reflect':6A,36B,87C 'run':55B 'script':40B,53B,76C 'site':39B,75C 'snippet':3A,24B,28B,82C,93C 'snippets':18A 'themeisl':20B,33B,79C 'visitor':58B 'vulner':77C 'web':70C 'woodi':1A,22B,26B,80C,91C 'woody':16A 'woody-ad-snippet':21B 'wordpress':4A,25B,30B 'xss':7A 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Woody ad snippets WordPress plugin at version 2.7.10 or earlier are in scope. The sources do not say whether the insert-php feature must be enabled for the flaw to be reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["adsnippets","woodyadsnippets"],"ptokens":["ad","snippets","woody"],"labels":["high","other","themeisle","vendor","woodyadsnippets","wordpress"],"campaign_type":null,"search_a":"'-124420':12A,15A '-2026':11A,14A '2.7.10':9A 'ad':2A,17A 'cve':10A,13A 'plugin':5A 'reflect':6A 'snippet':3A 'snippets':18A 'woodi':1A 'woody':16A 'wordpress':4A 'xss':7A","search_b":"'ad':23B,27B 'attack':49B 'browser':60B 'craft':63B 'cross':38B 'cross-sit':37B 'featur':47B 'flaw':41B 'get':51B 'insert':45B 'insert-php':44B 'link':64B 'malici':52B 'php':46B 'plugin':31B 'reflect':36B 'run':55B 'script':40B,53B 'site':39B 'snippet':24B,28B 'themeisl':20B,33B 'visitor':58B 'woodi':22B,26B 'woody-ad-snippet':21B 'wordpress':25B,30B","search_c":"'2.7.10':97C 'ad':81C,92C 'affect':90C 'allow':86C 'cross':74C 'cross-sit':73C 'generat':72C 'improp':65C 'input':68C 'insert':84C 'insert-php':83C 'issu':89C 'n/a':95C 'neutral':66C 'page':71C 'php':85C 'reflect':87C 'script':76C 'site':75C 'snippet':82C,93C 'themeisl':79C 'vulner':77C 'web':70C 'woodi':80C,91C 'xss.this':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124420","severity":null,"published_at":"2026-11-13T15:17:37+00:00","modified_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}