WordPress security by component
Ad Inserter
Plugin description
Ad Inserter is a WordPress component with 13 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 8.8.
Plugin slug:
ad-inserterLatest vulnerability
CVE-2026-57693: Ad Inserter: Cross-site scripting
Ad Inserter is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.8.11.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57693
Ad Inserter: Cross-site scripting
Ad Inserter is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.8.11.
|
2.8.12 |
CVE6.5
NVDPending
|
| Jul 03, 2026 |
CVE-2026-11900
Ad Inserter – Ad Manager & AdSense Ads: A security weakness
Ad Inserter – Ad Manager & AdSense Ads is affected by a security weakness. Exploitation requires at least contributor-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.8.16.
|
> 2.8.16 |
CVE4.3
NVDPending
|
| Jun 06, 2026 |
CVE-2026-9280
Ad Inserter – Ad Manager & AdSense Ads: Cross-site scripting
Ad Inserter – Ad Manager & AdSense Ads is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.8.15.
|
> 2.8.15 |
CVE6.1
NVDPending
|
| Nov 05, 2025 |
CVE-2025-11745
Ad Inserter – Ad Manager & AdSense Ads: Cross-site scripting
Ad Inserter – Ad Manager & AdSense Ads is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Mar 06, 2025 |
CVE-2025-22623
Ad Inserter: A security weakness
Ad Inserter is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.1
NVDPending
|
| Oct 17, 2024 |
CVE-2024-49248
Ad Inserter: Cross-site scripting
Ad Inserter is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVDPending
|
| Oct 20, 2023 |
CVE-2023-4668
Ad Inserter: Sensitive information exposure
Ad Inserter is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVD7.5
|
| Oct 19, 2023 |
CVE-2023-4645
Ad Inserter: Sensitive information exposure
Ad Inserter is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVD5.3
|
| May 15, 2023 |
CVE-2023-1549
Ad Inserter: Code execution
Ad Inserter is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
NVD7.2
|
| Apr 04, 2022 |
CVE-2022-0901
Ad Inserter: Cross-site scripting
Ad Inserter is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Oct 22, 2019 |
CVE-2015-9497
Ad Inserter: Cross-site scripting
Ad Inserter is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Aug 22, 2019 |
CVE-2019-15324
Ad Inserter: Code execution
Ad Inserter is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Aug 22, 2019 |
CVE-2019-15323
Ad Inserter: Filesystem traversal
Ad Inserter is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVD7.5
|