What is the CVSS score of CVE-2026-2595?

CVE-2026-2595 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2595?

Organizations using for WordPress is vulnerable to Stored Cross-Site Scripting in should be aware of moderate risk from CVE-2026-2595, a cross-site scripting vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-2595?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting i and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-2595

EUVD-2026-16919 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-28 Wordfence

WordPress XSS Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 28, 2026 - 11:45 euvd

EUVD-2026-16919

Analysis Generated

Mar 28, 2026 - 11:45 vuln.today

CVE Published

Mar 28, 2026 - 11:26 nvd

MEDIUM 5.4

DescriptionCVE.org

The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.98.1 due to insufficient input sanitization and output escaping of multiple ad metadata parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting (XSS) in Quads Ads Manager for Google AdSense plugin for WordPress up to version 2.0.98.1 allows authenticated attackers with Contributor-level or higher permissions to inject malicious scripts into ad metadata fields that execute in the browsers of all site visitors, potentially enabling session hijacking, credential theft, or malware distribution. CVSS 5.4 reflects the requirement for authenticated access and user interaction (page visit), but the stored nature and broad audience impact elevate real-world risk. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw affecting server-side rendered content. The Quads Ads Manager plugin (CPE: cpe:2.3:a:wpquads:quads_ads_manager_for_google_adsense:*:*:*:*:*:*:*:*) handles ad metadata parameters (titles, descriptions, URLs, and other ad-related fields) that are stored in the WordPress database without sufficient sanitization during input and are output to frontend pages without proper HTML entity encoding or escaping. This permits authenticated contributors to inject JavaScript payloads that are persisted server-side and executed in the DOM context of every page visit by any user, including administrators. The vulnerability affects the ad metadata layer rather than core WordPress or Google AdSense APIs, indicating a plugin-specific implementation flaw.

RemediationAI

Update the Quads Ads Manager for Google AdSense plugin to a patched version beyond 2.0.98.1. The vendor has released a fix available in the WordPress.org plugin repository (see changeset 3467744 linked in references for technical details on the patch). To remediate: (1) Log in to WordPress admin dashboard, navigate to Plugins > Installed Plugins, find Quads Ads Manager for Google AdSense, and click Update if a newer version is available; (2) verify the plugin version is newer than 2.0.98.1 after update; (3) audit ad metadata fields (titles, descriptions, URLs) for any suspicious or malformed content that may have been injected while the site was vulnerable. As a temporary workaround pending patching, restrict Contributor-level role permissions or reduce the number of users with ad metadata edit capabilities; however, this is not a substitute for patching. Consult the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/99051b12-5a24-4108-9ea4-81f37a1c1b35?source=cve) for additional details.