Ad Inserter
Monthly
Unauthenticated cross-site scripting in the Ad Inserter WordPress plugin affects versions through 2.8.19 and lets a remote attacker inject script that executes in a victim's browser after the victim is induced to load or click crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is required but user interaction is decisive, and impact is bounded to the victim's browser/session context rather than server takeover. The signals point to a moderate, not emergency, priority, and no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.
Reflected cross-site scripting in the WordPress plugin Ad Inserter (versions through 2.8.18) allows an attacker to have a crafted request reflected into a page the plugin generates, executing script in the context of a targeted logged-in victim's browser; the flaw is rated CVSS 6.5 (medium, CWE-79) and was reported by Patchstack. Exploitation is constrained by a mandatory user-interaction step (UI:R) and by the fact that each victim must be individually lured, and only sites running the affected plugin versions are exposed. There is no KEV listing and no public exploit identified at time of analysis; the supplied CVSS vector scores PR:L while the independent assessment re-scores the vector as PR:N, so the exact authentication prerequisite is not confirmed from available data.
Reflected cross-site scripting in the WordPress plugin Ad Inserter (versions through 2.8.18) lets a low-privilege actor craft a request or URL carrying a script payload and execute it in a victim's browser once that victim is persuaded to follow the link. Rated medium severity at CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw is non-persistent and requires victim interaction, so abuse depends on social engineering rather than a silent remote compromise. No confirmed active exploitation (not in CISA KEV) and no working exploit code is documented in the available sources; the report originates from Patchstack and is prioritized as a this-month item, with applicability limited to Ad Inserter up to and including 2.8.18.
Stored cross-site scripting in the Ad Inserter WordPress plugin (all versions through 2.8.18) allows an authenticated low-privilege user - a contributor, author, or any role permitted to create or edit ad blocks - to persist malicious script into plugin ad configuration, which then executes in the browser of another user, typically an administrator, when that page or the plugin's settings screen is rendered. Successful exploitation is bounded by two prerequisites: the attacker must already hold a suitably privileged WordPress account, and a second user must view the poisoned content, so this is not remotely exploitable against a default install by an anonymous visitor. Independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5, moderate), and no public exploit identified at time of analysis; EPSS data was not supplied, so no exploitation-probability estimate can be cited.
Cross-site scripting in the Ad Inserter WordPress plugin (Spacetime, versions through 2.8.11) allows authenticated low-privilege users to inject malicious JavaScript into pages served to other site visitors. The CVSS scope-change metric (S:C) confirms the vulnerability crosses the security boundary from the plugin into victims' browser contexts, enabling session theft or unauthorized action execution on behalf of targeted users. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority category for WordPress operators running affected versions.
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ad-inserter plugin before 2.4.20 for WordPress has path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated cross-site scripting in the Ad Inserter WordPress plugin affects versions through 2.8.19 and lets a remote attacker inject script that executes in a victim's browser after the victim is induced to load or click crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is required but user interaction is decisive, and impact is bounded to the victim's browser/session context rather than server takeover. The signals point to a moderate, not emergency, priority, and no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.
Reflected cross-site scripting in the WordPress plugin Ad Inserter (versions through 2.8.18) allows an attacker to have a crafted request reflected into a page the plugin generates, executing script in the context of a targeted logged-in victim's browser; the flaw is rated CVSS 6.5 (medium, CWE-79) and was reported by Patchstack. Exploitation is constrained by a mandatory user-interaction step (UI:R) and by the fact that each victim must be individually lured, and only sites running the affected plugin versions are exposed. There is no KEV listing and no public exploit identified at time of analysis; the supplied CVSS vector scores PR:L while the independent assessment re-scores the vector as PR:N, so the exact authentication prerequisite is not confirmed from available data.
Reflected cross-site scripting in the WordPress plugin Ad Inserter (versions through 2.8.18) lets a low-privilege actor craft a request or URL carrying a script payload and execute it in a victim's browser once that victim is persuaded to follow the link. Rated medium severity at CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw is non-persistent and requires victim interaction, so abuse depends on social engineering rather than a silent remote compromise. No confirmed active exploitation (not in CISA KEV) and no working exploit code is documented in the available sources; the report originates from Patchstack and is prioritized as a this-month item, with applicability limited to Ad Inserter up to and including 2.8.18.
Stored cross-site scripting in the Ad Inserter WordPress plugin (all versions through 2.8.18) allows an authenticated low-privilege user - a contributor, author, or any role permitted to create or edit ad blocks - to persist malicious script into plugin ad configuration, which then executes in the browser of another user, typically an administrator, when that page or the plugin's settings screen is rendered. Successful exploitation is bounded by two prerequisites: the attacker must already hold a suitably privileged WordPress account, and a second user must view the poisoned content, so this is not remotely exploitable against a default install by an anonymous visitor. Independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5, moderate), and no public exploit identified at time of analysis; EPSS data was not supplied, so no exploitation-probability estimate can be cited.
Cross-site scripting in the Ad Inserter WordPress plugin (Spacetime, versions through 2.8.11) allows authenticated low-privilege users to inject malicious JavaScript into pages served to other site visitors. The CVSS scope-change metric (S:C) confirms the vulnerability crosses the security boundary from the plugin into victims' browser contexts, enabling session theft or unauthorized action execution on behalf of targeted users. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority category for WordPress operators running affected versions.
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ad-inserter plugin before 2.4.20 for WordPress has path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.