Advanced Ads shortcode parameters permit contributor stored XSS
Advanced Ads before 2.0.23 lets a Contributor store attacker-controlled markup in an insufficiently sanitized shortcode parameter. The payload is later rendered without safe escaping and can execute in the browser of an administrator or other privileged visitor who views the affected content. The CNA record does not identify the shortcode, parameter, submission path or rendering function.
- Component
- Advanced Ads
- Plugin slug
advanced-ads- Affected
- < 2.0.23
- Safe version
2.0.23- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
Update Advanced Ads to 2.0.23 or later. Review Contributor-authored shortcodes for unexpected markup and remove suspicious content before administrators view affected posts or ad-management pages.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N