CVE-2026-105077: Cross-site scripting in Ad Inserter

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress. This flaw affects all plugin versions up to, and including, 2.8.19. A patch is available in version 2.8.20. There is no evidence of active exploitation.

Affected and patched versions

• Ad Inserter – Ad Manager & AdSense Ads (plugin ad-inserter): affected 2.8.19 and earlier; fixed in 2.8.20

Is my site vulnerable?

To determine if your WordPress site uses a vulnerable version of the Ad Inserter – Ad Manager & AdSense Ads plugin, you can check the installed version through your WordPress administration dashboard.

1. Log in to your WordPress admin area.

2. Navigate to the "Plugins" section in the left-hand menu.

3. Locate "Ad Inserter – Ad Manager & AdSense Ads" in the list of installed plugins.

4. The version number is displayed next to the plugin name.

If the displayed version is 2.8.19 or earlier, your site is running a vulnerable version of the plugin. If the version is 2.8.20 or higher, your site is using a patched version.

Alternatively, you can check the plugin's version by accessing your site's file system via SFTP or your hosting control panel's file manager. Navigate to wp-content/plugins/ad-inserter/ and open the ad-inserter.php file. The plugin version is typically defined near the top of this file.

What an attacker actually does

The Ad Inserter – Ad Manager & AdSense Ads plugin contains a Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-105077. This vulnerability stems from insufficient input sanitization and output escaping within the plugin's code. Input sanitization is the process of cleaning user-supplied data to remove or neutralize potentially harmful characters or code, while output escaping ensures that data displayed on a web page is treated as plain text rather than executable code. When these security measures are inadequate, an attacker can inject malicious scripts into the website.

An unauthenticated attacker can exploit this flaw by submitting specially crafted input that includes arbitrary web scripts. Because the plugin does not properly sanitize this input before storing it in the database or other persistent storage, the malicious script becomes a permanent part of the website's content. This injected script is then served to any user who accesses a page where the compromised content is displayed. For a plugin like Ad Inserter, this could involve ad blocks, custom code snippets, or other content managed by the plugin.

When a user's browser loads a page containing the injected script, the browser executes the script as if it were legitimate content from the site. This execution occurs within the context of the user's browser session. The consequences of such an attack can vary depending on the attacker's objectives and the nature of the injected script. Potential outcomes include session hijacking, where an attacker steals a user's session cookies to gain unauthorized access to their account; website defacement, by altering the appearance of the page; or redirection of users to malicious websites. Attackers could also use these scripts to steal sensitive information displayed on the page, such as user credentials or other data, or to perform actions on behalf of the user without their knowledge. The vulnerability is categorized under CWE-79, which describes improper neutralization of input during web page generation.

How to detect a compromise

Detecting a compromise related to a Stored Cross-Site Scripting vulnerability can involve several steps, as the malicious script is embedded within the site's content. Since the Ad Inserter plugin manages ad content and custom code, focus your inspection on areas where this plugin's output appears.

1. Review Plugin Settings: Access the Ad Inserter plugin's settings pages within your WordPress administration dashboard. Carefully examine all input fields, ad block configurations, and custom code areas for any unexpected or suspicious script tags, javascript: URIs, or encoded content (e.g., Base64 encoded strings that decode to scripts). Look for <script> tags, onerror attributes, or other HTML attributes that can execute JavaScript.

2. Inspect Page Source: Visit various pages on your website where the Ad Inserter plugin displays content, such as blog posts, pages with ad blocks, or custom templates. View the page source in your web browser (typically by right-clicking and selecting "View Page Source" or "Inspect Element"). Search for unusual or unexpected <script> tags, <iframe> elements, or inline JavaScript within HTML attributes that are not part of your site's legitimate code. Pay close attention to the HTML generated by the Ad Inserter plugin.

3. Database Inspection: For Stored XSS, the malicious payload resides in your WordPress database. You can use tools like phpMyAdmin or WP-CLI to search for suspicious content.

   • Using WP-CLI: If you have WP-CLI installed, you can search your database for common script patterns. The Ad Inserter plugin often stores its settings and ad code in the wp_options table. It might also inject into wp_posts if it modifies post content directly.

     wp db search '<script>' --tables=wp_options,wp_posts --regex --all-tables-with-prefix
     wp db search 'javascript:' --tables=wp_options,wp_posts --regex --all-tables-with-prefix

     Review the output for any entries that contain unexpected script code.

   • Using phpMyAdmin: Access your database via phpMyAdmin. Select your WordPress database and then search within the wp_options and wp_posts tables for keywords like <script>, onerror, or javascript:. Be cautious when modifying database entries directly.

4. File System Scan: While Stored XSS primarily affects the database, it is prudent to scan your plugin directory for any unauthorized file modifications. Attackers might attempt to drop web shells or modify existing plugin files.

   grep -rE "(<script|eval\(|base64_decode)" wp-content/plugins/ad-inserter/

   This command searches for common indicators of malicious code within the plugin's files.

5. Traffic Monitoring: Monitor your website's network traffic for unusual outbound requests or redirects that originate from user browsers after visiting your site. This could indicate an active XSS payload attempting to exfiltrate data or redirect users.

If you identify any suspicious code, document its location and content before attempting to remove it.

How to fix

Addressing the CVE-2026-105077 vulnerability in the Ad Inserter – Ad Manager & AdSense Ads plugin involves updating the plugin and performing post-update checks.

1. Update the Plugin: The primary remediation step is to update the Ad Inserter – Ad Manager & AdSense Ads plugin to version 2.8.20 or a later supported release. This version includes a security fix specifically for Cross-Site Scripting (XSS) by implementing improved input sanitization and output escaping.

   • Log in to your WordPress administration dashboard.

   • Navigate to the "Plugins" section.

   • Locate "Ad Inserter – Ad Manager & AdSense Ads" and click the "Update Now" link if an update is available. If no update notification appears, manually check for updates or download the latest version from the WordPress plugin repository and install it.

2. Review and Clean Injected Content: After updating the plugin, it is important to review your site for any previously injected malicious scripts. Since this is a Stored XSS vulnerability, the malicious code may persist in your database even after the plugin is updated.

   • Carefully examine all Ad Inserter plugin settings, ad blocks, and any content areas where the plugin's output appears for suspicious script tags or encoded content.

   • If you identified any injected content during the detection phase, remove it from the respective database entries or plugin settings.

3. Clear Caches: If your site uses caching plugins or a Content Delivery Network (CDN), clear all caches after updating and cleaning to ensure that visitors receive the updated, clean versions of your pages.

4. Regular Security Practices: Implement regular security audits and content reviews for all user-generated or administrator-managed content, especially within plugins that handle dynamic content. This practice helps to identify and mitigate potential vulnerabilities before they can be exploited.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-105077

• https://www.wordfence.com/threat-intel/vulnerabilities/id/e13e6e17-5db4-4b4b-830f-eb6ce5439a6d

• https://wordpress.org/plugins/ad-inserter/

• https://www.cve.org/CVERecord?id=CVE-2026-105077