CVE-2026-10082 is a CWE-79 Cross-Site Scripting vulnerability in the Advanced Ads WordPress plugin. The issue arises because the plugin does not sanitize and escape a shortcode parameter before rendering it in the page output. This flaw enables users with Contributor role or above to inject malicious scripts that execute in the context of other users viewing the affected content, including administrators. The vulnerability affects versions prior to 2.0.23, although no explicit affected versions were provided. The CVSS 3.1 base score is 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required beyond Contributor, user interaction required, scope changed, and limited confidentiality and integrity impact.

Successful exploitation allows users with Contributor role or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected content. This can lead to theft of session tokens, privilege escalation, or other malicious actions performed with the privileges of the victim user. The impact is limited to confidentiality and integrity, with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.0.23, upgrading to version 2.0.23 or later is likely the intended remediation once available. Until then, restrict Contributor role permissions or avoid using the vulnerable shortcode parameters if possible.