Ad Inserter Pro Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39.

Affected:

up to 2.8.0

Fixed in:

2.8.0

Disclosed:

Feb 16, 2025

CVE-2025-22680 on NVD →

The Ad Inserter Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.7.39 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success...

CVSS:

6.1

Affected:

up to 2.7.39

Fixed in:

2.8.0

Disclosed:

Feb 3, 2025

CVE-2025-22680 on NVD →

The Ad Inserter Pro plugin for WordPress is vulnerable to Arbitrary File Modification in versions 2.7.15 via unknown mechanisms. The Wordfence Threat Intelligence team conducted a thorough review of the vulnerable plugin and could not determine a vulnerable component in the plugin, which leads us to believe there may h...

CVSS:

8.1

Affected:

up to 2.7.15

Fixed in:

2.7.16

Disclosed:

Jun 28, 2022

The Ad Inserter Pro plugin for WordPress is vulnerable to Arbitrary File Modification in versions 2.7.15 via unknown mechanisms. The Wordfence Threat Intelligence team conducted a thorough review of the vulnerable plugin and could not determine a vulnerable component in the plugin, which leads us to believe there may h...

Affected:

up to 2.7.16

Fixed in:

2.7.16

Disclosed:

Jun 28, 2022

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

CVSS:

6.1

Affected:

up to 2.7.12

Fixed in:

2.7.12

Disclosed:

Apr 7, 2022

CVE-2022-0901 on NVD →

[en] The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

Affected:

up to 2.7.12

Fixed in:

2.7.12

Disclosed:

Apr 4, 2022

CVE-2022-0901 on NVD →

[en] The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Affected:

up to 2.7.12

Fixed in:

2.7.12

Disclosed:

Feb 21, 2022

CVE-2022-0288 on NVD →