CVE-2026-19902
Received Received - Intake

Reflected Cross-Site Scripting in Ad Inserter WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Wordfence

Description
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the '{search-query}' dynamic tag. When an ad block's code contains that tag, replace_ai_tags() reads $_SERVER['HTTP_REFERER'] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as '/google.com/' passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting 'q' (or 'p') value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the '{search-query}' tag with automatic insertion enabled — a documented plugin feature used as intended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-19902
EUVD
EUVD-2026-90545

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
advanced_ads ad_inserter to 2.8.18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the Ad Inserter WordPress plugin. It occurs due to insufficient input sanitization and output escaping when handling the Referer header. Attackers can exploit it by tricking users into visiting a malicious page that injects arbitrary JavaScript into the site, affecting any visitor including administrators.

Detection Guidance

This vulnerability is specific to WordPress sites using the Ad Inserter plugin. To detect it, inspect your WordPress site for the presence of the Ad Inserter plugin and check if any ad blocks use the '{search-query}' dynamic tag with automatic insertion enabled. Review server logs for unusual referrer headers or JavaScript execution patterns.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or deface your website. Since the exploit works by luring users to an attacker-controlled page, even non-technical visitors could be affected if they interact with a crafted link or frame.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if exploited on healthcare-related sites. Both standards mandate protecting user data from unauthorized access.

Mitigation Strategies

Immediately update the Ad Inserter plugin to the latest version beyond 2.8.18. If an update is not available, disable the plugin temporarily or remove ad blocks using the '{search-query}' tag. Monitor your site for suspicious activity and consider implementing a web application firewall.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart