An attacker can inject malicious code into a website running the Ad Inserter plugin, which stores the code due to improper input handling. When a user visits…
Affected component: Ad Inserter – Ad Manager & AdSense Ads (plugin)
Fixed in: 2.8.20
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 5, 2026. No PowerSEC firewall rule blocks this attack. Update to 2.8.20 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-105077