Ad Inserter CVE-2026-105077

Exploitation targets the Ad Inserter WordPress plugin at version 2.8.19 or earlier and requires no authentication (PR:N). The decisive limiting factor is required user interaction (UI:R): a victim must be induced to load or click attacker-crafted content for the injected script to execute, so this is not a silent server-side compromise. The specific vulnerable feature, parameter, or input field is not described in the available sources (only the Patchstack advisory reference is provided). Impact is bounded to the browser/session context of the victim (C:L/I:L/A:L with scope change), not full server takeover.

The signals point to a moderate, not emergency, priority. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity flaw needing no privileges (PR:N = unauthenticated) but requiring user interaction (UI:R), with a scope change (S:C) and limited confidentiality/integrity/availability impact - a profile consistent with reflected/stored Cross-Site Scripting (CWE-79). The vuln.today decision label is 'this_week', indicating prompt but not immediate action. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no evidence of active exploitation or mass weaponization; this reads as a legitimate but not top-tier priority. Key caveat: the only reference is a Patchstack advisory whose contents were not provided, so the exact injection point and whether the XSS is reflected or stored are not stated in the available sources - the UI:R requirement means a victim must be induced to trigger the payload, which meaningfully limits drive-by mass exploitation despite the unauthenticated vector.

An unauthenticated attacker crafts a malicious URL or input targeting a vulnerable parameter in the Ad Inserter plugin (<= 2.8.19) and lures a logged-in site visitor or administrator into visiting it; the UI:R requirement means the victim must click or load the crafted content. When the payload renders unsanitized, attacker-controlled JavaScript executes in the victim's browser session, potentially stealing cookies or performing actions in the victim's context. No confirmed public exploit code was identified in the provided data, and the precise trigger is not described in the available sources.