EUVD-2026-16919Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.98.1 due to insufficient input sanitization and output escaping of multiple ad metadata parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in Quads Ads Manager for Google AdSense plugin for WordPress up to version 2.0.98.1 allows authenticated attackers with Contributor-level or higher permissions to inject malicious scripts into ad metadata fields that execute in the browsers of all site visitors, potentially enabling session hijacking, credential theft, or malware distribution. CVSS 5.4 reflects the requirement for authenticated access and user interaction (page visit), but the stored nature and broad audience impact elevate real-world risk. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw affecting server-side rendered content. The Quads Ads Manager plugin (CPE: cpe:2.3:a:wpquads:quads_ads_manager_for_google_adsense:*:*:*:*:*:*:*:*) handles ad metadata parameters (titles, descriptions, URLs, and other ad-related fields) that are stored in the WordPress database without sufficient sanitization during input and are output to frontend pages without proper HTML entity encoding or escaping. This permits authenticated contributors to inject JavaScript payloads that are persisted server-side and executed in the DOM context of every page visit by any user, including administrators. The vulnerability affects the ad metadata layer rather than core WordPress or Google AdSense APIs, indicating a plugin-specific implementation flaw.
RemediationAI
Update the Quads Ads Manager for Google AdSense plugin to a patched version beyond 2.0.98.1. The vendor has released a fix available in the WordPress.org plugin repository (see changeset 3467744 linked in references for technical details on the patch). To remediate: (1) Log in to WordPress admin dashboard, navigate to Plugins > Installed Plugins, find Quads Ads Manager for Google AdSense, and click Update if a newer version is available; (2) verify the plugin version is newer than 2.0.98.1 after update; (3) audit ad metadata fields (titles, descriptions, URLs) for any suspicious or malformed content that may have been injected while the site was vulnerable. As a temporary workaround pending patching, restrict Contributor-level role permissions or reduce the number of users with ad metadata edit capabilities; however, this is not a substitute for patching. Consult the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/99051b12-5a24-4108-9ea4-81f37a1c1b35?source=cve) for additional details.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today