CVE-2026-97077

HighCVSS 7.1/10Last modified Sep 30, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-970785.3Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.CVE-2026-970794.3Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.CVE-2026-97084.9Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has acceCVE-2026-97097.7The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated uCVE-2026-97107.7The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes theCVE-2026-97119.8The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' CVE-2026-97123.8When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35CVE-2026-97137.5The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uCVE-2026-97146.4The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortCVE-2026-971464.8Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod hasCVE-2026-971477.2In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projecCVE-2026-971495.3In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only co
CVE-2026-97077: High severity, CVSS 7.1 | Vulnix