CVE-2026-9280

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.11/class.php#L3460
• https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.11/class.php#L3462
• https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.11/class.php#L3470
• https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.15/class.php#L3460
• https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.15/class.php#L3462
• https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.15/class.php#L3470
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3552607%40ad-inserter&new=3552607%40ad-inserter&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0d40c05d-dc30-47b1-aea5-cd2b72d4c4c0?source=cve

Published

Jun 6, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
• CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
• CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
• CVE-2026-9277shell-quote's `quote()` function did not validate object-tok…9.2
• CVE-2026-9278The Form Builder CP WordPress plugin before 1.2.47 does not …5.4
• CVE-2026-9279Logseq exposes an IPC handler that allows the renderer proce…8.7
• CVE-2026-9281The Master Addons For Elementor – Widgets, Extensions, Theme…6.4
• CVE-2026-9282The W3 Total Cache plugin for WordPress is vulnerable to Dir…7.5
• CVE-2026-9284The WooCommerce PayPal Payments plugin for WordPress is vuln…8.2
• CVE-2026-9290The WP User Manager – User Profile Builder & Membership plug…7.5
• CVE-2026-9291Insecure deserialization in the job results processing compo…7.5
• CVE-2026-9292A Stored Cross-Site Scripting security issue exists within F…8.4