Advanced Ads
Monthly
Remote code execution in the Monetizemore Advanced Ads WordPress plugin through version 2.0.21 allows authenticated attackers with low privileges to inject and execute arbitrary code via a code injection flaw (CWE-94). The issue was disclosed by Patchstack and carries a CVSS 3.1 base score of 7.5 (high) with high attack complexity. No public exploit identified at time of analysis.
Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.
Remote code execution in the Monetizemore Advanced Ads WordPress plugin through version 2.0.21 allows authenticated attackers with low privileges to inject and execute arbitrary code via a code injection flaw (CWE-94). The issue was disclosed by Patchstack and carries a CVSS 3.1 base score of 7.5 (high) with high attack complexity. No public exploit identified at time of analysis.
Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.