CVE Database /
CVE-2026-9280
CVE · Medium
CVE-2026-9280 — Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.16
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-9280
|
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.16 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 2.8.16
|
2.8.16 |
2026-06-05 |
—
|
CVE-2026-9280
The Ad Inserter plugin has a security flaw in its handling of URL parameters when displaying ads in iframe mode. This weakness allows malicious scripts to be injected into pages viewed by users who click on links that exploit the vulnerability, even if they're not logged in. The issue affects all versions up to and including 2.8.15, which can display ads with iframe mode enabled.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings