CVE-2026-57693
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Ad Inserter WordPress plugin version 2.8.11 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The flaw allows an attacker to exploit incorrectly configured access control security levels.
Risk Assessment
An attacker can inject malicious JavaScript code into pages generated by the plugin, potentially leading to session hijacking, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Ad Inserter plugin to the latest available version that fixes this vulnerability. Additionally, review the plugin's access control configuration.
Other vulnerabilities in Ad Inserter
See all- CVE-2026-11984Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.
- CVE-2026-11983Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.