Ad Inserter EUVD-2026-89895

Exploitation requires the Ad Inserter plugin (version 2.8.18 or earlier) installed and active on a WordPress site, plus victim user interaction (UI:R) - the target must click a crafted link or visit an attacker-influenced page for the injected script to execute. No authentication is needed (PR:N), and it is reachable over the network against default configurations, but the dependency on tricking a user into interaction is the primary limiting factor; the description does not name the specific injectable parameter or feature, so the exact input sink should be confirmed from the Patchstack advisory.

The single provided signal set is internally consistent: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 HIGH) describes a network-reachable, low-complexity, unauthenticated cross-site scripting flaw whose exploitation requires victim interaction (UI:R) and crosses a security boundary (S:C, script executing in the user's browser context). No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The 7.1 rating is driven largely by the scope change and the unauthenticated network vector rather than by severe technical impact - confidentiality, integrity and availability are each only Low. This is a real but moderate priority: unauthenticated XSS in a widely-deployed WordPress plugin is worth patching promptly, but the mandatory user interaction, the Low CIA impacts, and the absence of any exploitation or automation signal (no KEV, no EPSS, no POC) place it well below wormable or actively-exploited threats. The description does not specify whether the XSS is reflected or stored; the UI:R metric implies a reflected/social-engineered variant, but this should be verified against the Patchstack advisory.

An attacker crafts a malicious URL or web page targeting a WordPress site running Ad Inserter <= 2.8.18 and lures a visitor or administrator into clicking it. Because no authentication is required (PR:N) but user interaction is (UI:R), the injected JavaScript executes in the victim's browser session, enabling session/cookie theft, admin-panel actions, or redirection. No public proof-of-concept is identified in the provided data.