---
id: "CVE-2026-102905"
kind: "vulnerability"
aliases: ["CVE-2026-102905"]
title: "Ad Inserter WordPress plugin lets unauthenticated visitors run arbitrary shortcodes"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ad-inserter", "package", "wordpress", "wp-plugin"]
not_affected_if: ["no-dynamic-tag-ad-block", "no-search-page-display", "plugin-not-installed"]
published_at: "2026-10-30T18:17:14+00:00"
first_seen_at: "2026-10-30T18:55:28+00:00"
updated_at: "2026-10-30T18:57:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102905", "first_seen_at": "2026-10-30T18:55:28+00:00"}]
---

# Ad Inserter WordPress plugin lets unauthenticated visitors run arbitrary shortcodes

The Ad Inserter plugin for WordPress passes an unvalidated value to do_shortcode, so anyone can make the site run arbitrary WordPress shortcodes. An attacker gets whatever those shortcodes can do on the site, which depends on what other plugins register.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ad Inserter version in the WordPress admin plugin list or `wp plugin get ad-inserter --field=version`
- Look for an ad block with a dynamic tag such as {title}, {tag}, {category} or {smart-tag} shown on search pages

## Fix

- Ad Inserter versions up to and including `2.8.19` are affected; the sources do not name a fixed version

## Timeline

- 2026-10-30T18:55:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102905

## From the sources

The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, which is a normal and documented plugin configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_