CVE-2024-49248

The Ad Inserter plugin contains a reflected cross-site scripting flaw in versions through 2.7.37 stemming from inadequate sanitization of user input and lack of proper output encoding. An unauthenticated attacker could craft a malicious link that, when clicked by a user, would allow arbitrary JavaScript code to execute within the affected page. The vulnerability requires social engineering to trick a victim into clicking the specially crafted link.

Based on public CVE data (MITRE/NVD).