CVE-2026-114194: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Igor Funa Ad Inserter

The vulnerability identified as CVE-2026-114194 affects the Igor Funa Ad Inserter plugin versions prior to 2.8.19. It is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that can be executed in the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, requires low privileges and user interaction, and impacts confidentiality, integrity, and availability with low to partial severity. No known exploits in the wild have been reported.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure to untrusted input and applying web application firewall rules to detect and block reflected XSS attempts.