# CVE-2026-114194: Igor Funa Ad Inserter reflected XSS in plugin settings

Source: https://junglewise.ai/threats/cve-2026-114194-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-24. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

CVE-2026-114194 · Severity: medium · CVSS 6.5 · Published 2026-10-24

The Ad Inserter plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) that requires user interaction to exploit. A contributor-level user or attacker could inject malicious scripts through crafted links or forms, allowing theft of visitor data or account hijacking. The vulnerability affects Ad Inserter versions up to 2.8.18 and has been fixed in version 2.8.19.

Technologies: [Igor Funa Ad Inserter](https://junglewise.ai/threats/technologies/ad-inserter). Vendors: [Igor Funa](https://junglewise.ai/threats/vendors/igor-funa).

## Quick answers

**Is CVE-2026-114194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114194 being exploited in the wild.

**How severe is CVE-2026-114194?** Medium severity, with a CVSS score of 6.5, published 24 October 2026.

**Which products and versions are affected?** Igor Funa Ad Inserter up to 2.8.18.

**Is there a fix for CVE-2026-114194?** Yes: fixed in 2.8.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114194 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114194?** Check whether you run Igor Funa Ad Inserter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.8.19

## Technical details

Improper input neutralization in the Ad Inserter plugin allows reflected XSS attacks when generating web pages. Exploitation requires either a privileged user (contributor/developer role) to interact with a malicious link, or a visitor to click an attacker-controlled link. An attacker can inject arbitrary JavaScript into the page context to steal session data or perform actions on behalf of the victim.

## Affected products

- Igor Funa Ad Inserter up to 2.8.18

## Timeline

- 2026-10-20: disclosed
- 2026-10-22: advisory
- 2026-10-24: other: Published in NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/ad-inserter/vulnerability/wordpress-ad-inserter-plugin-2-8-18-cross-site-scripting-xss-vulnerability-3?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ad-inserter/vulnerability/wordpress-ad-inserter-plugin-2-8-18-cross-site-scripting-xss-vulnerability-3?_s_id=cve)

## Related threats

- [Igor Funa Ad Inserter XSS in content injection](https://junglewise.ai/threats/cve-2026-124262-improper-neutralization-of-script-related-html-tags-in-a-web)
- [Ad Inserter cross-site scripting in plugin](https://junglewise.ai/threats/cve-2026-105077-unauthenticated-cross-site-scripting-xss-in-ad-inserter-2-8-19)
- [Igor Funa Ad Inserter stored cross-site scripting](https://junglewise.ai/threats/cve-2026-118094-improper-neutralization-of-input-during-web-page-generation)
- [Igor Funa Ad Inserter reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-114709-improper-neutralization-of-input-during-web-page-generation)
- [Igor Funa Ad Inserter stored cross-site scripting](https://junglewise.ai/threats/cve-2026-107864-improper-neutralization-of-input-during-web-page-generation)