CVE-2026-114194
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Igor Funa Ad Inserter
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- 🚨 CVE-2026-114194 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad InsTelegram: CVE Notify, 24 Oct 2026
- @offseq.bsky.social: Reflected XSS in Igor Funa Ad Inserter (<2.8.19). MEDIUM severity (CVSS 6.5). Limit untrusted input, use WAF, and monitor for updates. Patch status unconfirmed. Details: https://raBluesky: CVE posts, 24 Oct 2026
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Text from CVE List
Affected versions 1
- Ad Inserteraffected: all versions through 2.8.18CVE List