What is the CVSS score of CVE-2026-57693?

CVE-2026-57693 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Ad Inserter CVE-2026-57693

EUVD-2026-43355 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Ad Inserter Wordpress Plugin Spacetime

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

XSS via low-privilege authenticated user requires victim interaction; availability impact is not a realistic primary outcome for ad plugin XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:22 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.

AnalysisAI

Cross-site scripting in the Ad Inserter WordPress plugin (Spacetime, versions through 2.8.11) allows authenticated low-privilege users to inject malicious JavaScript into pages served to other site visitors. The CVSS scope-change metric (S:C) confirms the vulnerability crosses the security boundary from the plugin into victims' browser contexts, enabling session theft or unauthorized action execution on behalf of targeted users. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority category for WordPress operators running affected versions.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied data before it is rendered as HTML or JavaScript in a browser. The Ad Inserter plugin by Spacetime is a widely-used WordPress ad management tool that allows users to inject code blocks - including JavaScript ad tags - into page templates, making it a natural target for XSS if input is not properly neutralized. The affected CPE cpe:2.3:a:spacetime:ad_inserter:*:*:*:*:*:*:*:* covers all versions up to and including 2.8.11. The CVSS scope-changed (S:C) metric is consistent with classic stored or reflected XSS where the exploited component (the plugin) affects a separate security scope (the victim's browser session). The tag 'Exploiting Incorrectly Configured Access Control Security Levels' suggests the injection point may be accessible to roles that should not normally write executable content, compounding the risk.

RemediationAI

Update the Ad Inserter plugin to a version beyond 2.8.11. The exact patched release version is not confirmed in the available data - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ad-inserter/vulnerability/wordpress-ad-inserter-plugin-2-8-11-cross-site-scripting-xss-vulnerability and the WordPress.org plugin repository for the current patched release. As a compensating control prior to patching, restrict the Ad Inserter settings interface to administrator-level roles only, removing access for contributor, author, and editor roles - this directly addresses the 'Incorrectly Configured Access Control' element cited in the vulnerability description. Additionally, audit existing ad code blocks within the plugin for any previously injected suspicious script content. Deploying a WordPress Web Application Firewall rule targeting XSS payloads in plugin settings POST requests can provide an additional layer of defense but may interfere with legitimate JavaScript ad tag insertion.