Spacetime
Monthly
Unauthenticated cross-site scripting in the Ad Inserter WordPress plugin affects versions through 2.8.19 and lets a remote attacker inject script that executes in a victim's browser after the victim is induced to load or click crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is required but user interaction is decisive, and impact is bounded to the victim's browser/session context rather than server takeover. The signals point to a moderate, not emergency, priority, and no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated visitors to WordPress sites running Ad Inserter through version 2.8.19 can trigger execution of arbitrary registered shortcodes when an administrator has placed an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} and enabled that block on search pages, because the plugin passes an unvalidated value into do_shortcode(). The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), limiting impact to low confidentiality and integrity with no availability effect, and no public exploit was identified at time of analysis; CISA SSVC records exploitation as none, with automatable exploitation and partial technical impact, and the vulnerability is rated for this-month remediation rather than emergency action.
Sensitive information exposure in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress lets any authenticated user at subscriber level or above pull diagnostic and environment data out of the site through the plugin's ai_wp_footer_hook code path, affecting all releases up to and including 2.8.18. The leaked material spans the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and every post meta value - including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the main constraint is the account requirement, so sites that allow open subscriber self-registration have a materially larger exposure surface than sites that restrict registration to trusted users.
Reflected cross-site scripting (XSS) in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin through 2.8.18 allows unauthenticated attackers to inject arbitrary script through the 's' search parameter, which executes in a victim's browser if they are tricked into clicking a crafted link. Real-world exploitation is constrained by two gates: an administrator must have configured at least one block using the {title} or {short-title} placeholder with that block enabled on search pages (a documented but non-default setting), and a victim must interact with the malicious URL (CVSS UI:R). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was provided; the issue is fixed in version 2.8.19.
Reflected cross-site scripting in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress affects all versions up to and including 2.8.18, letting unauthenticated remote attackers run arbitrary JavaScript in a victim's browser session. The flaw lives in the '{search-query}' dynamic tag: when an ad block uses that tag, the plugin reads the Referer header, is trivially fooled by any referrer containing a '/google.com/'-style segment, and injects the decoded query string into the page without escaping. Because the request is cross-site and carries no authentication privilege (PR:N), the attacker must lure a victim - ideally a signed-in administrator - to an attacker-controlled page that frames or links to an ordinary post on the target site (UI:R); the configuration precondition is a site that uses the '{search-query}' tag with automatic insertion enabled, an opt-in, non-default feature. No public exploit code was identified at time of analysis, and no CISA KEV entry is associated with this CVE; the vulnerability is fixed in plugin version 2.8.19.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded `ai_ajax` AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.
Cross-site scripting in the Ad Inserter WordPress plugin (Spacetime, versions through 2.8.11) allows authenticated low-privilege users to inject malicious JavaScript into pages served to other site visitors. The CVSS scope-change metric (S:C) confirms the vulnerability crosses the security boundary from the plugin into victims' browser contexts, enabling session theft or unauthorized action execution on behalf of targeted users. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority category for WordPress operators running affected versions.
Insecure Direct Object Reference in the Ad Inserter WordPress plugin (versions up to and including 2.8.16) allows authenticated Contributor-level users to read the full content of arbitrary posts they do not own or have permission to view, including Private, Draft, Pending, Trashed, and password-protected posts. The flaw exists in the shortcode processing function replace_ai_tags(), which fetches post content by a user-supplied numeric ID without any authorization check, post-type restriction, or status filtering. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Reflected XSS in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin (all versions through 2.8.15) enables unauthenticated attackers to inject arbitrary JavaScript into victim browsers by crafting malicious URLs targeting pages where iframe mode is active. The vulnerability exists because URL parameters passed through the plugin's iframe rendering path (class.php lines 3460, 3462, 3470) are insufficiently sanitized before output. Exploitation is contingent on a non-default configuration (iframe mode enabled) and requires social engineering to make a user click a crafted link, but no public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in the Ad Inserter WordPress plugin affects versions through 2.8.19 and lets a remote attacker inject script that executes in a victim's browser after the victim is induced to load or click crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is required but user interaction is decisive, and impact is bounded to the victim's browser/session context rather than server takeover. The signals point to a moderate, not emergency, priority, and no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated visitors to WordPress sites running Ad Inserter through version 2.8.19 can trigger execution of arbitrary registered shortcodes when an administrator has placed an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} and enabled that block on search pages, because the plugin passes an unvalidated value into do_shortcode(). The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), limiting impact to low confidentiality and integrity with no availability effect, and no public exploit was identified at time of analysis; CISA SSVC records exploitation as none, with automatable exploitation and partial technical impact, and the vulnerability is rated for this-month remediation rather than emergency action.
Sensitive information exposure in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress lets any authenticated user at subscriber level or above pull diagnostic and environment data out of the site through the plugin's ai_wp_footer_hook code path, affecting all releases up to and including 2.8.18. The leaked material spans the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and every post meta value - including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the main constraint is the account requirement, so sites that allow open subscriber self-registration have a materially larger exposure surface than sites that restrict registration to trusted users.
Reflected cross-site scripting (XSS) in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin through 2.8.18 allows unauthenticated attackers to inject arbitrary script through the 's' search parameter, which executes in a victim's browser if they are tricked into clicking a crafted link. Real-world exploitation is constrained by two gates: an administrator must have configured at least one block using the {title} or {short-title} placeholder with that block enabled on search pages (a documented but non-default setting), and a victim must interact with the malicious URL (CVSS UI:R). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was provided; the issue is fixed in version 2.8.19.
Reflected cross-site scripting in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress affects all versions up to and including 2.8.18, letting unauthenticated remote attackers run arbitrary JavaScript in a victim's browser session. The flaw lives in the '{search-query}' dynamic tag: when an ad block uses that tag, the plugin reads the Referer header, is trivially fooled by any referrer containing a '/google.com/'-style segment, and injects the decoded query string into the page without escaping. Because the request is cross-site and carries no authentication privilege (PR:N), the attacker must lure a victim - ideally a signed-in administrator - to an attacker-controlled page that frames or links to an ordinary post on the target site (UI:R); the configuration precondition is a site that uses the '{search-query}' tag with automatic insertion enabled, an opt-in, non-default feature. No public exploit code was identified at time of analysis, and no CISA KEV entry is associated with this CVE; the vulnerability is fixed in plugin version 2.8.19.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded `ai_ajax` AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.
Cross-site scripting in the Ad Inserter WordPress plugin (Spacetime, versions through 2.8.11) allows authenticated low-privilege users to inject malicious JavaScript into pages served to other site visitors. The CVSS scope-change metric (S:C) confirms the vulnerability crosses the security boundary from the plugin into victims' browser contexts, enabling session theft or unauthorized action execution on behalf of targeted users. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority category for WordPress operators running affected versions.
Insecure Direct Object Reference in the Ad Inserter WordPress plugin (versions up to and including 2.8.16) allows authenticated Contributor-level users to read the full content of arbitrary posts they do not own or have permission to view, including Private, Draft, Pending, Trashed, and password-protected posts. The flaw exists in the shortcode processing function replace_ai_tags(), which fetches post content by a user-supplied numeric ID without any authorization check, post-type restriction, or status filtering. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Reflected XSS in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin (all versions through 2.8.15) enables unauthenticated attackers to inject arbitrary JavaScript into victim browsers by crafting malicious URLs targeting pages where iframe mode is active. The vulnerability exists because URL parameters passed through the plugin's iframe rendering path (class.php lines 3460, 3462, 3470) are insufficiently sanitized before output. Exploitation is contingent on a non-default configuration (iframe mode enabled) and requires social engineering to make a user click a crafted link, but no public exploit code has been identified at time of analysis.