CVE-2026-0690

Name of the Vulnerable Software and Affected Versions FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress versions through 3.2.2

Description The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress has a Stored Cross-Site Scripting issue. This is due to inadequate sanitization of user-supplied data and insufficient output escaping when handling the rank math description custom field. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute when other users access the compromised pages.

Recommendations Update FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress to a version later than 3.2.2.