CVE-2026-19902Published
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-19902 · Microsoft / collected KEV context
cve-program · CVE-2026-19902
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d632cce-40a9-4969-b213-8370ae75287e?source=cve
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13093
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13018
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13022
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13025
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/class.php#L3297
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3709970%40ad-inserter%2Ftags%2F2.8.19&old=3624916%40ad-inserter%2Ftags%2F2.8.18
- https://plugins.trac.wordpress.org/changeset/3709957/ad-inserter/trunk/ad-inserter.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.