https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:14:20 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19902 <p>The Ad Inserter – Ad Manager &amp; AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the &#39;{search-query}&#39; dynamic tag. When an ad block&#39;s code contains that tag, replace_ai_tags() reads $_SERVER[&#39;HTTP_REFERER&#39;] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as &#39;/google.com/&#39; passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting &#39;q&#39; (or &#39;p&#39;) value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the &#39;{search-query}&#39; tag with automatic insertion enabled — a documented plugin feature used as intended.</p> <p>The Ad Inserter – Ad Manager &amp; AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the &#39;{search-query}&#39; dynamic tag. When an ad block&#39;s code contains that tag, replace_ai_tags() reads $_SERVER[&#39;HTTP_REFERER&#39;] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as &#39;/google.com/&#39; passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting &#39;q&#39; (or &#39;p&#39;) value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the &#39;{search-query}&#39; tag with automatic insertion enabled — a documented plugin feature used as intended.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19902 https://vulnerability.circl.lu/vuln/ghsa-298r-885r-pj27 <p>The Ad Inserter – Ad Manager &amp; AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the &#39;{search-query}&#39; dynamic tag. When an ad block&#39;s code contains that tag, replace_ai_tags() reads $_SERVER[&#39;HTTP_REFERER&#39;] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as &#39;/google.com/&#39; passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting &#39;q&#39; (or &#39;p&#39;) value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the &#39;{search-query}&#39; tag with automatic insertion enabled — a documented plugin feature used as intended.</p> <p>The Ad Inserter – Ad Manager &amp; AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the &#39;{search-query}&#39; dynamic tag. When an ad block&#39;s code contains that tag, replace_ai_tags() reads $_SERVER[&#39;HTTP_REFERER&#39;] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as &#39;/google.com/&#39; passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting &#39;q&#39; (or &#39;p&#39;) value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the &#39;{search-query}&#39; tag with automatic insertion enabled — a documented plugin feature used as intended.</p> https://vulnerability.circl.lu/vuln/ghsa-298r-885r-pj27