CVE-2026-81655
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its…
- Risk score
- 48/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is t…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.8.19 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
References
Original description
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
Last activity 27 Sep 2026. Patch Forecast updates every hour.