WordPress plugin
Advanced Ads – Ad Manager & AdSense security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium7
- Low0
All Advanced Ads – Ad Manager & AdSense vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Authenticated (Subscriber+) Information Exposure ≤2.0.26Update to 2.0.27 | CVE-2026-94180 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.0.22Update to 2.0.23 | CVE-2026-10082 | |
| High8.3 | Authenticated (Contributor+) Remote Code Execution ≤2.0.21Update to 2.0.22 | CVE-2026-54816 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Ad Placements Update ≤2.0.14Update to 2.0.15 | CVE-2025-12884 | |
| Medium4.9 | Authenticated (Admin+) SQL Injection ≤2.0.15Update to 2.0.16 | CVE-2025-12984 | |
| High7.2 | Authenticated (Editor+) Remote Code Execution via Shortcode ≤2.0.14Update to 2.0.15 | CVE-2025-13592 | |
| High7.3 | Unauthenticated Limited Code Execution ≤2.0.12Update to 2.0.13 | CVE-2025-10487 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget ≤1.52.1Update to 1.52.2 | CVE-2024-3952 | |
| High7.2 | Authenticated (Admin+) PHP Object Injection ≤1.52.1Update to 1.52.2 | CVE-2024-2290 | |
| Medium5.5 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤1.31.1Update to 1.32.0 | CVE-2022-32776 | |
| Medium6.1 | Reflected Cross-Site Scripting <1.17.4Update to 1.17.4 | — |
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤2.0.26Update to 2.0.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.22Update to 2.0.23
- High8.3Authenticated (Contributor+) Remote Code Execution
≤2.0.21Update to 2.0.22
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Ad Placements Update
≤2.0.14Update to 2.0.15
- Medium4.9Authenticated (Admin+) SQL Injection
≤2.0.15Update to 2.0.16
- High7.2Authenticated (Editor+) Remote Code Execution via Shortcode
≤2.0.14Update to 2.0.15
- High7.3Unauthenticated Limited Code Execution
≤2.0.12Update to 2.0.13
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget
≤1.52.1Update to 1.52.2
- High7.2Authenticated (Admin+) PHP Object Injection
≤1.52.1Update to 1.52.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.31.1Update to 1.32.0
- Medium6.1Reflected Cross-Site Scripting
<1.17.4Update to 1.17.4
Advanced Ads – Ad Manager & AdSense: common questions
Does Advanced Ads – Ad Manager & AdSense have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in Advanced Ads – Ad Manager & AdSense: 4 high, 7 medium. None are known to affect version null.
How do I check which version of Advanced Ads – Ad Manager & AdSense I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Advanced Ads – Ad Manager & AdSense vulnerability?
CVE-2026-94180, published Oct 2, 2026: Advanced Ads – Ad Manager & AdSense <= 2.0.26 - Authenticated (Subscriber+) Information Exposure. Severity: Medium (CVSS 4.3).
Is any Advanced Ads – Ad Manager & AdSense vulnerability listed in CISA KEV?
No. None of the known Advanced Ads – Ad Manager & AdSense vulnerabilities is currently listed in the CISA KEV catalog.