WordPress plugin
Ad Inserter – Ad Manager & AdSense Ads security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High7
- Medium22
- Low0
All Ad Inserter – Ad Manager & AdSense Ads vulnerabilities
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
≤2.8.19Update to 2.8.20
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.19Update to 2.8.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.18Update to 2.8.19
- Medium6.1Reflected Cross-Site Scripting
≤2.8.18Update to 2.8.19
- Medium6.1Reflected Cross-Site Scripting
≤2.8.18Update to 2.8.19
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.18Update to 2.8.19
- Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
≤2.8.18Update to 2.8.19
- Medium6.1Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
≤2.8.18Update to 2.8.19
- Medium6.42.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
2.8.12 – 2.8.18Update to 2.8.19
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
≤2.8.16Update to 2.8.17
- Medium5.3Missing Authorization to Block Visibility Bypass via ai_ajax
≤2.8.16Update to 2.8.17
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.8.11Update to 2.8.12
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute
≤2.8.16Update to 2.8.17
- Medium6.1Reflected Cross-Site Scripting via URL Parameters in iframe Mode
≤2.8.15Update to 2.8.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
≤2.8.7Update to 2.8.8
- Medium6.1Ad Manager and AdSense Ads <= 2.8.0 - Reflected Cross-Site Scripting
≤2.8.0Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
≤2.7.37Update to 2.7.38
- Medium5.3Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
≤2.7.30Update to 2.7.31
- Medium5.3Unauthenticated Sensitive Information Exposure via ai_ajax
≤2.7.30Update to 2.7.31
- High7.2Authenticated (Admin+) PHP Object Injection
≤2.7.25Update to 2.7.26
- Medium6.1Reflected Cross-Site Scripting
<2.7.12Update to 2.7.12
- High7.2Authenticated (Admin+) Remote Code Execution
<2.7.11Update to 2.7.11
- Medium6.1Reflected Cross-Site Scripting
<2.7.10Update to 2.7.10
- High8.8Authenticated Remote Code Execution
≤2.4.21Update to 2.4.22
- High7.5Authenticated Path Traversal
≤2.4.19Update to 2.4.20
- Medium4.8Cross-Site Request Forgery to Cross-Site Scripting
≤1.5.5Update to 1.5.6
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
<1.5.3Update to 1.5.3
Ad Inserter – Ad Manager & AdSense Ads: common questions
Does Ad Inserter – Ad Manager & AdSense Ads have known vulnerabilities?
Yes. VulnCrest Radar lists 29 known vulnerabilities in Ad Inserter – Ad Manager & AdSense Ads: 7 high, 22 medium. None are known to affect version null.
How do I check which version of Ad Inserter – Ad Manager & AdSense Ads I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Ad Inserter – Ad Manager & AdSense Ads vulnerability?
CVE-2026-102905, published Oct 30, 2026: Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter. Severity: Medium (CVSS 6.5).
Is any Ad Inserter – Ad Manager & AdSense Ads vulnerability listed in CISA KEV?
No. None of the known Ad Inserter – Ad Manager & AdSense Ads vulnerabilities is currently listed in the CISA KEV catalog.