EUVD-2026-90572

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-90545

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

CVE-2026-89427: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-103740

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a site administrator...

CVE-2026-19902: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

PT-2026-103716

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Reflected Cross-Site Scripting is possible via the Referer header due to insufficient input sanitization and output escaping on the search-query dynamic tag. The repla...

CVE-2026-11984: Missing Authorization

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

PT-2026-68468

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.17 Description An authorization bypass exists due to a missing capability check in the ai ajax function. This flaw allows unauthenticated attackers to view the contents of ad blocks...

CVE-2026-11983: Missing Authorization

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the aiajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that ...

Manage Engine AD Search Detection

Manage Engine AD Manager service can be configured to allow anonymous users to browse the AD list remotely. !/usr/bin/env python3 -- coding: utf-8 -- """Manage Engine AD Manager service can be configured to allow anonymous users to browse the AD list remotely.""" from kittysploit import from...

CVE-2026-11900: Authorization Bypass Through User-Controlled Key

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

WordPress plugin Ad Inserter – Ad Manager & AdSense Ads cross-site scripting vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

CVE-2026-9280: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress Ad Manager Wd plugin <= 1.0.11 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by ? in WordPress Plugin Ad Manager Wd versions = 1.0.11...

CVE-2019-25727 WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=exportcsv and a malicious path paramet...

CVE-2019-25727

The CVE-2019-25727 entry describes an Arbitrary File Download vulnerability in WordPress Plugin ad manager wd 1.0.11. An unauthenticated attacker can target the edit.php endpoint by supplying export=export_csv and a malicious path parameter to read sensitive files accessible to the web server (e....

WordPress plugin ad manager: path traversal vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-46197

Name of the Vulnerable Software and Affected Versions ad manager wd version 1.0.11 Description An arbitrary file download issue allows unauthenticated attackers to retrieve sensitive files from the web server. By sending GET requests to the 'edit.php' endpoint with the export parameter set to...

CVE-2019-25727: Improper Limitation of a Pathname to a Restricted Directory

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=exportcsv and a malicious path paramet...

CVE-2025-12884

CVE-2025-12884 — The WordPress plugin Advanced Ads – Ad Manager & AdSense is vulnerable to an authorization bypass in versions up to and including 2.0.14 via the function placement_update_item(). This allows authenticated attackers with subscriber-level access and above to update ad placements, p...