Ad Inserter EUVD-2026-109261

Reflected (non-persistent) XSS: the attacker must build a crafted request/URL containing the script payload and then induce a victim to follow it (UI:R), so success depends on social engineering rather than a silent remote hit. The vector's PR:L indicates exploitation is tied to a low-privilege/authenticated context rather than fully anonymous abuse, and authentication requirements beyond that are not further detailed in the sources. The exact vulnerable parameter, screen, or plugin feature that reflects the input is not described in the available evidence. Limiting factors for defenders: required victim interaction, the low-privilege prerequisite, the non-persistent nature (payload is not stored), and applicability only to Ad Inserter versions up to 2.8.18.

This is a medium-severity reflected XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in the Ad Inserter WordPress plugin, reported by Patchstack. The signals are internally consistent and point to a moderate, not urgent, priority. The network vector and low attack complexity are offset by two real constraints baked into the vector: PR:L means the attacker (or the context) requires some authenticated/low-privilege state, and UI:R means a victim must perform an action (clicking a crafted link) for the reflected payload to fire - reflected XSS is not self-propagating and depends on social engineering. The scope change (S:C) is why impact crosses into the victim's browser context and raises the score above a plain XSS. On the exploitation side the picture is quiet: there is no CISA KEV listing (not actively exploited per available data), no EPSS probability was supplied in the input so widespread-exploitation likelihood cannot be quantified, and no verified public exploit code is present - only the Patchstack advisory reference. The vuln.today decision label is 'this_month', which aligns with routine scheduled patching rather than emergency action. Net: a legitimate issue to remediate on a normal cadence, not a high-CVSS-but-illusory risk, but also not an active-exploitation emergency; the user-interaction and privilege prerequisites meaningfully limit real-world attack reliability.

An attacker crafts a URL (or request) carrying a malicious script payload aimed at the vulnerable Ad Inserter parameter and lures a logged-in WordPress user into clicking it; the input is reflected unsanitized into the generated page and the script executes in the victim's authenticated browser session, enabling session/cookie theft or actions performed as that user. The specific injectable parameter is not described in the available sources. No public exploit code is identified at time of analysis - only a vendor advisory reference exists.