Ad Inserter EUVD-2026-109720

Exploitation requires a victim to actively interact with an attacker-supplied request (UI:R) - typically following a crafted link that reflects the malicious payload back into a page generated by Ad Inserter (versions up to and including 2.8.18). The supplied CVSS vector lists PR:L, indicating some low-level privilege as scored; however the sources do not describe exactly which parameter or page is vulnerable or whether the victim/attacker must be authenticated, so the precise authentication prerequisite is not confirmed from available data. Limiting factors: the mandatory user interaction, the plugin-specific attack surface (only sites running Ad Inserter ≤ 2.8.18 are affected), and the per-request, non-persistent nature of reflected XSS (each victim must be individually lured) all constrain realistic exploitation.

This is a reflected cross-site scripting flaw (CWE-79) in the Ad Inserter WordPress plugin, rated CVSS 6.5 (medium). The supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L is network-reachable with low complexity but is gated by two meaningful brakes: it requires user interaction (UI:R - a victim must follow an attacker-crafted request/link) and, as scored, some privilege level (PR:L). The scope change (S:C) reflects XSS executing in the victim's browser context rather than the server. On the decision signals: there is no CISA KEV listing, no EPSS probability supplied in the input, and the vuln.today priority is 'this_month' (not act_now/emergency), so this is a routine-patch-cycle item rather than an active-exploitation fire drill. No public exploit was identified in the provided data - the single reference is the Patchstack advisory, which is an advisory record, not verified working exploit code. Net: a genuine but moderate issue typical of plugin reflected XSS - worth remediating on the normal monthly cadence, not an emergency. One conflict worth flagging: reflected XSS is usually deliverable by an unauthenticated attacker via a crafted link, yet the input vector lists PR:L; the available sources do not describe the trigger, so the exact privilege prerequisite should be verified against the Patchstack advisory.

An attacker crafts a malicious URL targeting a vulnerable parameter handled by Ad Inserter (up to version 2.8.18) and lures a logged-in WordPress user into opening it. The unsanitized input is reflected into the generated page, executing attacker JavaScript in the victim's browser session, which can steal session data or perform actions as that user. No verified working exploit code was found in the provided sources; only the Patchstack advisory is referenced.