{"id":"CVE-2026-102905","kind":"vulnerability","aliases":["CVE-2026-102905"],"related":[],"title":"Ad Inserter WordPress plugin lets unauthenticated visitors run arbitrary shortcodes","description":"The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, which is a normal and documented plugin configuration.","summary":"The Ad Inserter plugin for WordPress passes an unvalidated value to do_shortcode, so anyone can make the site run arbitrary WordPress shortcodes. An attacker gets whatever those shortcodes can do on the site, which depends on what other plugins register.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ad-inserter","package","wordpress","wp-plugin"],"not_affected_if":["no-dynamic-tag-ad-block","no-search-page-display","plugin-not-installed"],"how_to_check":"- Check the installed Ad Inserter version in the WordPress admin plugin list or `wp plugin get ad-inserter --field=version`\n- Look for an ad block with a dynamic tag such as {title}, {tag}, {category} or {smart-tag} shown on search pages","fix":"- Ad Inserter versions up to and including `2.8.19` are affected; the sources do not name a fixed version","status":"open","published_at":"2026-10-30T18:17:14+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","triaged_at":"2026-10-30T18:57:01+00:00","updated_at":"2026-10-30T18:57:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:57:01Z","model":"claude-haiku-5-5","output":{"fix":"- Ad Inserter versions up to and including `2.8.19` are affected; the sources do not name a fixed version","reach":"internet","title":"Ad Inserter WordPress plugin lets unauthenticated visitors run arbitrary shortcodes","impact":"medium","summary":"The Ad Inserter plugin for WordPress passes an unvalidated value to do_shortcode, so anyone can make the site run arbitrary WordPress shortcodes. An attacker gets whatever those shortcodes can do on the site, which depends on what other plugins register.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","ad-inserter"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated visitors run arbitrary WordPress shortcodes on the site","analyst_note":"Confirm the fixed version and the worst-case impact from the NVD entry and the plugin vendor's changelog.","how_to_check":"- Check the installed Ad Inserter version in the WordPress admin plugin list or `wp plugin get ad-inserter --field=version`\n- Look for an ad block with a dynamic tag such as {title}, {tag}, {category} or {smart-tag} shown on search pages","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-dynamic-tag-ad-block","no-search-page-display"],"who_is_affected":"Sites running Ad Inserter `2.8.19` or earlier where an administrator has an ad block with a dynamic tag shown on search pages. Sites without the plugin, or without such an ad block, are not exposed according to the description. The sources do not say what the worst shortcode impact is on a given site.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000747,"input_tokens":4245,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102905':13A,16A '-2026':12A,15A '2.8.19':90C 'action':102C 'ad':1A,18B,26B,68C,70C,73C,133C 'ad-insert':17B 'administr':128C 'adsens':72C 'allow':97C 'anyon':39B 'arbitrari':9A,45B,80C,123C 'attack':49B,120C 'block':134C 'categori':143C 'configur':131C,161C 'contain':135C 'cve':11A,14A 'depend':60B 'display':149C 'document':159C 'due':93C 'dynam':137C 'enabl':150C 'execut':82C,100C,122C 'exploit':125C 'get':50B 'includ':89C 'insert':2A,19B,27B,69C 'let':5A 'make':41B,115C 'manag':71C 'normal':157C 'packag':20B 'page':153C 'pass':31B 'plugin':4A,24B,28B,64B,74C,160C 'possibl':117C 'proper':106C 'regist':65B 'requir':126C 'run':8A,44B,111C 'search':152C 'shortcod':10A,37B,47B,53B,81C,113C,124C 'site':43B,58B 'smart':146C 'smart-tag':145C 'softwar':96C 'tag':138C,142C,147C 'titl':141C 'unauthent':6A,119C 'unvalid':33B 'user':98C 'valid':107C 'valu':34B,109C 'version':85C 'visitor':7A 'vulner':78C 'whatev':51B 'wordpress':3A,21B,30B,46B,76C 'wp':23B 'wp-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running Ad Inserter `2.8.19` or earlier where an administrator has an ad block with a dynamic tag shown on search pages. Sites without the plugin, or without such an ad block, are not exposed according to the description. The sources do not say what the worst shortcode impact is on a given site.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102905","severity":null,"published_at":"2026-10-30T18:17:14+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","fetched_at":"2026-10-30T18:55:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}