PT-2026-45698 · Ariyes · Wp Nano Ad

Siyuan Shao · CVE-2025-5085 · Published 2026-06-02 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Nano AD versions prior to 1.32

Description Insufficient input sanitization and output escaping in the blogrole link parameter allow authenticated attackers with administrator-level access to perform stored cross-site scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page. This issue specifically impacts multi-site installations and environments where unfiltered html has been disabled.

Recommendations Update to a version newer than 1.31. Avoid using the blogrole link parameter until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-5085

Affected Products

Wp Nano Ad

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-5085 · Security Note
• https://cor.wordpress.org/plugins/wp-nano-ad · Note
• https://reddit.com/r/StopBadBots/comments/1u38lfq/25_unpatched_wordpress_plugins_remove_them_today · Reddit Post
• https://github.com/BFS-Lab/BFSDV/blob/main/WP%20Nano%20Ads%20XSS.md · Note
• https://plugins.trac.wordpress.org/browser/wp-nano-ad/trunk/add_links.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/350c23c6-6201-4dd5-9594-edb7d8ad926c?source=cve · Note