Live › vulnerability › CVE-2026-102905
The Ad Inserter plugin for WordPress passes an unvalidated value to do_shortcode, so anyone can make the site run arbitrary WordPress shortcodes. An attacker gets whatever those shortcodes can do on the site, which depends on what other plugins register.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running Ad Inserter 2.8.19 or earlier where an administrator has an ad block with a dynamic tag shown on search pages. Sites without the plugin, or without such an ad block, are not exposed according to the description. The sources do not say what the worst shortcode impact is on a given site.
No product ranges from the sources yet.
wp plugin get ad-inserter --field=version2.8.19 are affected; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, which is a normal and documented plugin configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-102905")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.