CVE-2022-0288: Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-21 · updated 2026-06-17
Weakness: CWE-79

Description

The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Affected products

Ad Inserter Pro Project Ad Inserter Pro: before 2.7.10 — fixed in 2.7.10
Ad Inserter: before 2.7.10 — fixed in 2.7.10

How to fix

Upgrade to a fixed version: Ad Inserter Pro Project Ad Inserter Pro 2.7.10; Ad Inserter 2.7.10. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42
https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42

Get alerted when CVE-2022-0288 or the next vulnerability affects your stack