Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-03
Ad Inserter – Ad Manager & AdSense Ads - Security Vulnerability (CVE-2026-89427)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has configured at least one Ad Inserter block using the {title} or {short-title}…
PLUGIN
Ad Inserter – Ad Manager & AdSense Ads
CVE-2026-89427
Risk Score
Threat Entry
Updated 2026-10-03
Ad Inserter – Ad Manager & AdSense Ads - Security Vulnerability (CVE-2026-19902)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the '{search-query}' dynamic tag. When an ad block's code contains that tag, replace_ai_tags() reads $_SERVER['HTTP_REFERER'] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so any referrer merely containing a segment such as '/google.com/' passes as a search-engine referral; the plugin then percent-decodes the referring…
PLUGIN
Ad Inserter – Ad Manager & AdSense Ads
CVE-2026-19902
Risk Score
Threat Entry
Updated 2026-09-16
Ad Inserter – Ad Manager & AdSense Ads - Security Vulnerability (CVE-2026-11984)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.
PLUGIN
Ad Inserter – Ad Manager & AdSense Ads
CVE-2026-11984
Risk Score