[ CVE-2026-81655 · Published 27 Sep 2026 ]
Vulnerability in Unknown Ad Inserter
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.