# Ad Inserter – Ad Manager & AdSense Ads <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via Search Query and Post Data Tags

- **ID:** WPSEC-2026-1942
- **Plugin:** Ad Inserter – Ad Manager & AdSense Ads (`ad-inserter`), https://wordpress.org/plugins/ad-inserter/
- **Affected versions:** all versions before 2.8.20
- **Fixed in:** 2.8.20 (Update to 2.8.20 or later.)
- **Severity:** Medium 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ad-inserter
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1942/

## Description

The Ad Inserter plugin for WordPress is vulnerable to arbitrary shortcode execution via dynamic block-code tags in all versions up to, and including, 2.8.19. This is due to the plugin substituting values such as the search query, the search-engine referrer query, post titles, categories, tags and author names into block code through tags like {search-query}, {smart-tag}, {title} or {category} without neutralizing square brackets, before running the result through do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, for example by placing them in the site search query or in the referrer's search parameter, on sites where an ad block uses one of these tags.

## References

- https://wpsec.com/vuln/WPSEC-2026-1942/
- https://plugins.svn.wordpress.org/ad-inserter/tags/2.8.20/
- https://wordpress.org/plugins/ad-inserter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1942/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.