CVE-2026-102905
MEDIUM
MEDIUM
Priority: 0.03
BB Relevance:
73/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
Low
I:
Low
A:
None
Description
The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, which is a normal and documented plugin configuration.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| spacetime | Ad Inserter – Ad Manager & AdSense Ads | 0 |
| spacetime | Ad Inserter – Ad Manager & AdSense Ads | 0 |