CVE-2025-22623

🗓️ 06 Mar 2025 05:08:55Reported by Fluid AttacksType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

Ad Inserter 2.8.0 is vulnerable due to unvalidated dynamic web content generation in the application.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-22623	6 Mar 202505:35	–	circl
CNNVD	WordPress plugin Ad Inserter has a cross-site scripting vulnerability	6 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-22623 Ad Inserter - Reflected cross-site scripting (XSS)	6 Mar 202505:08	–	cvelist
EUVD	EUVD-2025-6118	3 Oct 202520:07	–	euvd
NVD	CVE-2025-22623	6 Mar 202505:15	–	nvd
Patchstack	WordPress Ad Inserter plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerability	14 Mar 202522:19	–	patchstack
Positive Technologies	PT-2025-9905	6 Mar 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-22623: Improper Neutralization of Input During Web Page Generation	6 Mar 202500:00	–	rapid7
RedhatCVE	CVE-2025-22623	8 Mar 202506:07	–	redhatcve
Vulnrichment	CVE-2025-22623 Ad Inserter - Reflected cross-site scripting (XSS)	6 Mar 202505:08	–	vulnrichment

Vulners

Node

ad_inserter_project ad_inserterMatch2.8.0

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "ad-inserter",
    "product": "Ad Inserter",
    "vendor": "Ad Inserter",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.0"
      }
    ]
  }
]

Source	Link
fluidattacks	www.fluidattacks.com/advisories/skims-8/
wordpress	www.wordpress.org/plugins/ad-inserter/

Parameter	Position	Path	Description	CWE
untrusted data	request body	/myapp/includes/dst/dst.php	The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/includes/dst/dst.php.	CWE-79

17 Jun 2026 08:48Current

8.3High risk

Vulners AI Score8.3

CVSS 45.1

EPSS0.00403

SSVC

CWE-79