CVE-2026-102905
The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary…
- Risk score
- 46/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.19/ad-inserter.php#L12974
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.19/ad-inserter.php#L13142
- https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.19/class.php#L3297
- https://plugins.trac.wordpress.org/changeset/3770281/ad-inserter/trunk/ad-inserter.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a36f813c-97c5-466d-92e0-7341c12b5a46?source=cve
Original description
The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, which is a normal and documented plugin configuration.
Last activity 30 Oct 2026. Patch Forecast updates every hour.