{
 "id": "WPSEC-2026-1942",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1942/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1942/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1942/index.md",
 "title": "Ad Inserter – Ad Manager & AdSense Ads <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via Search Query and Post Data Tags",
 "description": "The Ad Inserter plugin for WordPress is vulnerable to arbitrary shortcode execution via dynamic block-code tags in all versions up to, and including, 2.8.19. This is due to the plugin substituting values such as the search query, the search-engine referrer query, post titles, categories, tags and author names into block code through tags like {search-query}, {smart-tag}, {title} or {category} without neutralizing square brackets, before running the result through do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, for example by placing them in the site search query or in the referrer's search parameter, on sites where an ad block uses one of these tags.",
 "plugin": {
  "slug": "ad-inserter",
  "name": "Ad Inserter – Ad Manager & AdSense Ads",
  "full_name": "Ad Inserter – Ad Manager & AdSense Ads",
  "wordpress_org": "https://wordpress.org/plugins/ad-inserter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ad-inserter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ad-inserter"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.20",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.20"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.20",
 "remediation": "Update to 2.8.20 or later.",
 "fix_released": "2026-10-28T10:25:13+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:46:46.730215+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1942/",
  "https://plugins.svn.wordpress.org/ad-inserter/tags/2.8.20/",
  "https://wordpress.org/plugins/ad-inserter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ad-inserter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}