Is CVE-2026-19902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19902 being exploited in the wild.

How severe is CVE-2026-19902?

Medium severity, with a CVSS score of 6.1, published 1 October 2026.

Which products and versions are affected?

Automatic Ad Inserter up to and including 2.8.18.

Is there a fix for CVE-2026-19902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19902 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19902?

Check whether you run Automatic Ad Inserter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19902: Ad Inserter reflected cross-site scripting via Referer header

CVE-2026-19902 · Severity: medium · CVSS 6.1 · Published 2026-10-01

The Ad Inserter WordPress plugin, used to manage advertisements and Google AdSense placements on websites, is vulnerable to reflected cross-site scripting (XSS) attacks through the HTTP Referer header. An attacker can craft a malicious link that, when clicked by a site visitor, executes arbitrary JavaScript in their browser with the privileges of that user—including administrators. The vulnerability affects all versions up to 2.8.18 and exploits ad blocks configured to use the {search-query} dynamic tag.

Vendors: Automatic.

Quick answers

Is CVE-2026-19902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19902 being exploited in the wild.
How severe is CVE-2026-19902?: Medium severity, with a CVSS score of 6.1, published 1 October 2026.
Which products and versions are affected?: Automatic Ad Inserter up to and including 2.8.18.
Is there a fix for CVE-2026-19902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19902 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19902?: Check whether you run Automatic Ad Inserter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin's replace_ai_tags() function insufficiently validates the HTTP_REFERER to detect search-engine referrals, using a permissive regex that allows any referrer containing '/google.com/', '/yahoo.com/', or similar segments to pass validation. It then extracts the 'q' or 'p' query parameter via parse_str() and inserts it unescaped into ad block code via preg_replace(), enabling arbitrary JavaScript injection. No authentication is required; exploitation succeeds when an ad block with {search-query} tag and automatic insertion is configured, which is a documented intended feature.

Affected products

Automatic Ad Inserter up to and including 2.8.18

Timeline

2026-10-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.