CVE-2026-19902 is a reflected cross-site scripting vulnerability in the spacetime Ad Inserter – Ad Manager & AdSense Ads WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the '{search-query}' dynamic tag, which reads the HTTP Referer header and attempts to detect search engine referrals using a regex. The regex incorrectly matches any segment containing '/google.com/' or similar, allowing an attacker to inject malicious query parameters. The plugin then decodes and inserts these parameters into ad blocks without escaping, enabling arbitrary JavaScript execution in the victim's browser. This affects all versions up to and including 2.8.18.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the vulnerable site for any visitor, including signed-in administrators. This can lead to session hijacking, privilege escalation, or other malicious actions within the user's browser session. The vulnerability requires the site to have an ad block using the '{search-query}' tag with automatic insertion enabled, which is a documented feature of the plugin.

No official patch or fix is currently documented. Users should verify if their site uses the '{search-query}' dynamic tag in ad blocks with automatic insertion enabled and consider disabling this feature or removing the tag until a fix is available. Monitor the vendor's advisory channels for updates. Since this is a reflected XSS, avoiding use of the vulnerable tag or restricting access to ad blocks may reduce risk.