CVE-2026-102905

Name of the Vulnerable Software and Affected Versions The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress versions prior to 2.8.20

Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode() function. This issue occurs when an administrator configures an ad block containing dynamic tags such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages.

Recommendations Update the plugin to version 2.8.20 or later. As a temporary mitigation, disable the display of ad blocks containing dynamic tags on search pages.