Ad Inserter CVE-2026-89427

Exploitation requires that a site administrator has configured at least one Ad Inserter block using the {title} or {short-title} placeholder with that block enabled for search pages - a standard, documented feature but NOT a default configuration. Additionally, per CVSS UI:R, a victim must be tricked into clicking an attacker-crafted search URL (the 's' parameter carries the payload). The attack is unauthenticated (PR:N) from the attacker's side, but these two gates - the specific block/placeholder configuration AND required victim interaction - substantially limit realistic exploitation. Affects all versions of Ad Inserter - Ad Manager & AdSense Ads (vendor: spacetime) up to and including 2.8.18; fixed in 2.8.19.

This is a reflected Cross-Site Scripting flaw rated CVSS 6.1 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent: network-exploitable, low complexity, no privileges required, but it mandates user interaction (UI:R) - the victim must click a crafted link - which meaningfully caps real-world impact to session-scoped script execution (C:L/I:L, scope-changed S:C as the payload crosses into the victim's authenticated browser context). Crucially, exploitation is further gated by a non-default server-side precondition: a site admin must have configured an Ad Inserter block using the {title} or {short-title} placeholder AND enabled it for search pages. No EPSS score, KEV listing, or POC is provided, so exploitation status is: no public exploit identified at time of analysis. This is NOT a drop-everything priority - it is a classic reflected XSS requiring both social engineering and a specific (though documented and legitimate) plugin configuration. Its main risk amplifier is the plugin's very large install base, which raises the number of potentially-affected sites even though per-site exploitability depends on configuration. Treat as routine-patch priority.

An attacker crafts a malicious URL targeting the vulnerable site's search page with a JavaScript payload in the 's' search parameter and lures a logged-in user (e.g. an administrator) into clicking it via phishing. If the site has an Ad Inserter block using the {title}/{short-title} placeholder enabled on search pages, the unsanitized search term is reflected and the script executes in the victim's browser session. No public POC is referenced, and exploitation requires user interaction.