Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-07 | 1 | Disclosure1 |
| 2026-06-12 | 1 | PoC1 |
CVE-2026-9280 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to,… https://www.cve.org/CVERecord?id=CVE-2026-9280
Post summary
The Ad Inserter WordPress plugin is vulnerable to reflected XSS through URL parameters in iframe mode across all affected versions, as identified by CVE‑2026‑9280.
https://atomicedge.io/cve-proof/cve-2026-9280-ad-inserter-version-2-8-15-medium-vulnerability-proof-of-concept CVE-2026-9280 ad-inserter (CVSS Score 6.1) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cyb…
Post summary
The post shares a proof‑of‑concept for CVE‑2026‑9280 in the WordPress Ad Inserter plugin, providing a link and CVSS score, but offers no evidence of active exploitation, patches, or detailed exploit code.