What is the CVSS score of CVE-2026-9280?

CVE-2026-9280 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Ad Inserter Plugin CVE-2026-9280

EUVD-2026-34945 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-m3rj-j76j-78jj

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:51 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

MEDIUM 6.1

DescriptionCVE.org

The Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.

AnalysisAI

Reflected XSS in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin (all versions through 2.8.15) enables unauthenticated attackers to inject arbitrary JavaScript into victim browsers by crafting malicious URLs targeting pages where iframe mode is active. The vulnerability exists because URL parameters passed through the plugin's iframe rendering path (class.php lines 3460, 3462, 3470) are insufficiently sanitized before output. Exploitation is contingent on a non-default configuration (iframe mode enabled) and requires social engineering to make a user click a crafted link, but no public exploit code has been identified at time of analysis.

Technical ContextAI

Ad Inserter (vendor: Spacetime, CPE: cpe:2.3:a:spacetime:ad_inserter_-_ad_manager_&_adsense_ads:*:*:*:*:*:*:*:*) is a widely-used WordPress plugin for managing display advertising including AdSense and JavaScript-based ad units. The plugin's iframe mode (controlled by the AI_OPTION_IFRAME flag) renders ad content inside an iframe, with parameters passed via URL query strings. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause: user-supplied URL parameters are reflected into the iframe's HTML output without proper encoding or sanitization. The vulnerable code is localized to the plugin's main class file (class.php), specifically around lines 3460, 3462, and 3470 as documented in the WordPress plugin trac browser for both the 2.8.11 and 2.8.15 tagged releases, confirming the flaw spans multiple recent versions. The CVSS scope value of Changed (S:C) reflects that injected script executes in the browser context of the hosting WordPress site rather than the iframe origin.

RemediationAI

The upstream fix is confirmed in WordPress plugin repository changeset 3552607 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3552607%40ad-inserter&new=3552607%40ad-inserter); however, the exact patched release version number is not independently confirmed from available data - update to the latest available version from the WordPress plugin repository, which should include this changeset. As an immediate compensating control while patching, disable iframe mode (AI_OPTION_IFRAME) for all ad blocks in the Ad Inserter settings; note that this will affect AdSense and JavaScript-based ad delivery that depends on iframe rendering. Administrators can also implement a Web Application Firewall rule blocking requests with suspicious script payloads in URL parameters to pages serving Ad Inserter iframe-mode blocks. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0d40c05d-dc30-47b1-aea5-cd2b72d4c4c0 for further guidance.