Ad Inserter CVE-2026-107864

Exploitation requires the attacker to already hold an authenticated WordPress account with sufficient privilege to supply or modify Ad Inserter content/configuration (PR:L - a contributor/author or similar role, not an anonymous visitor), and requires a second user with access to the affected page - typically an administrator - to render it so the stored script executes (UI:R). This is not remote-unauthenticated against a default install. Limiting factors: the dependency on a pre-existing privileged account and on victim interaction significantly narrow the realistic attacker population; sites that tightly restrict who can edit ad configuration are largely insulated. Affected deployments are WordPress sites running Ad Inserter version through 2.8.18.

This is a moderate-severity Stored XSS (CWE-79) in the Ad Inserter WordPress plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The network vector and low complexity favor the attacker, but two factors meaningfully constrain real risk: PR:L means the attacker must already hold an authenticated, privileged account (at least a contributor/author-level role that can configure or influence ad code), and UI:R means a victim - typically an administrator - must subsequently view the page where the injected script executes. The scope change (S:C) reflects that the payload executes in the victim's browser context rather than the plugin's. No EPSS score, CISA KEV entry, or public POC was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. The only source is a single Patchstack advisory. Net assessment: a legitimate issue to patch, but a second-tier priority rather than an emergency - it is not remote-unauthenticated, it depends on both prior authenticated access and victim interaction, and no exploitation signal elevates it. Note that the impact metrics C:L/I:L/A:L from the input are slightly generous for a stored XSS, which typically carries no direct availability impact (see assessed vector below).

An attacker who has obtained a low-privileged authenticated account on a WordPress site (e.g., a contributor or author role able to influence Ad Inserter configuration) stores a malicious JavaScript payload through the plugin. When a site administrator later views the affected page in wp-admin or on the front end, the script executes in their authenticated browser session, enabling session/cookie theft or actions performed as the admin. No public exploit code was provided in the available intelligence.