CVE-2026-2595 is a stored cross-site scripting vulnerability in the Quads Ads Manager for Google AdSense WordPress plugin, affecting versions up to 2.0.98.1. The issue is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of multiple ad metadata parameters. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary scripts that execute when users access the compromised pages. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject malicious scripts into pages managed by the plugin. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or other client-side impacts. There is no indication of impact on system availability or integrity beyond the client-side script execution. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher access to trusted users only. Monitor plugin updates from the vendor and apply any released patches promptly.