CVE-2026-1795 is a reflected cross-site scripting vulnerability in the sivenso Address Bar Ads WordPress plugin. The flaw arises from improper neutralization of input during web page generation, specifically in the URL path handling, allowing injection of malicious scripts. This vulnerability affects all versions up to 1.0.0. Exploitation requires user interaction, such as clicking a crafted link, and can lead to partial confidentiality and integrity impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user data or perform actions on behalf of the user. The confidentiality and integrity impacts are low, and availability is not affected. No known exploits are currently reported in the wild.

No official patch or fix is currently available for this vulnerability. Users of the Address Bar Ads plugin should monitor the vendor's advisory channels for updates. Until a fix is released, consider disabling the plugin or applying manual input sanitization and output escaping if feasible. Avoid clicking on suspicious links that could trigger the vulnerability.