Ad Inserter – Ad Manager & AdSense Ads <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via Search Query and Post Data Tags
- ID
- WPSEC-2026-1942
- Plugin
- Ad Inserter – Ad Manager & AdSense Ads (ad-inserter)
- Affected
- all versions before 2.8.20
- Remediation
- Update to 2.8.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Ad Inserter – Ad Manager & AdSense Ads on WPSec AttackSurface
- Fix released
- Published
Description
The Ad Inserter plugin for WordPress is vulnerable to arbitrary shortcode execution via dynamic block-code tags in all versions up to, and including, 2.8.19. This is due to the plugin substituting values such as the search query, the search-engine referrer query, post titles, categories, tags and author names into block code through tags like {search-query}, {smart-tag}, {title} or {category} without neutralizing square brackets, before running the result through do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, for example by placing them in the site search query or in the referrer's search parameter, on sites where an ad block uses one of these tags.
References
- https://wpsec.com/vuln/WPSEC-2026-1942/
- https://plugins.svn.wordpress.org/ad-inserter/tags/2.8.20/
- https://wordpress.org/plugins/ad-inserter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS