Ad Inserter EUVD-2026-43355

Exploitation requires the attacker to hold an authenticated WordPress session with sufficient privilege to access the Ad Inserter plugin configuration - at minimum a low-privilege role such as contributor or editor (CVSS PR:L). The victim must then visit a page on the same WordPress site where the injected ad block is rendered (CVSS UI:R). The Ad Inserter plugin must be installed and active on the target site. Exploitation is limited by: (1) mandatory attacker authentication - unauthenticated remote exploitation is not indicated by the PR:L vector; (2) required victim interaction - passive server-side exploitation is not possible; (3) the vulnerability is confined to WordPress installations running Ad Inserter, not a general web platform issue. Sites that restrict Ad Inserter settings to administrator roles only are not exploitable by lower-privilege accounts.

The NVD CVSS 3.1 base score of 6.5 is supported by the vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. Real-world risk is moderate: exploitation requires an authenticated session (PR:L) and victim interaction (UI:R), meaningfully reducing the attacker population and attack surface compared to unauthenticated XSS. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public POC has been identified, further supporting a measured rather than urgent risk posture. The A:L (availability impact) in the official vector is debatable for a typical XSS scenario in an ad plugin - availability disruption is not a primary XSS outcome and may overstate that dimension. Overall, this is a real but not critical-priority finding: sites allowing untrusted authenticated users (e.g., contributors or editors) to interact with Ad Inserter settings face the most meaningful risk.

An attacker with a contributor or low-privilege author account on a WordPress site running Ad Inserter ≤ 2.8.11 navigates to the plugin's ad configuration interface and injects a malicious JavaScript payload into an ad code block. When an administrator or another authenticated user subsequently visits a page where that ad block renders, their browser executes the injected script - allowing the attacker to steal session cookies, perform authenticated actions as the victim, or escalate privileges to administrator. No public proof-of-concept exploit code has been identified at time of analysis.