CVE-2026-9280

MediumCVSS 6.1

Published: 06/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin up to version 2.8.15 is vulnerable to Reflected Cross-Site Scripting via URL parameters in iframe mode. Unauthenticated attackers can inject arbitrary scripts if they trick a user into clicking a link, and iframe mode is enabled on at least one ad block.

Risk Assessment

An attacker can execute scripts in the victim's browser, potentially leading to session theft, content modification, or redirection to malicious sites.

Recommendation

Update the plugin to the latest version. If not possible, consider disabling iframe mode for ad blocks or applying additional URL parameter filtering.

Other vulnerabilities in Ad Inserter – Ad Manager & AdSense Ads

CVE-2026-11900Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.16 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'data' attribute of the [adinserter] shortcode. The replace_ai_tags() function processes a {reusable-block-N} tag pattern calling get_post_field('post_content', N) without verifying user capabilities, restricting the post type to 'wp_block', or checking the post status.

Original NVD description (English source)

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS