Advanced Ads Vulnerabilities

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary...

CVSS:

6.4

Affected:

up to 2.0.22

Fixed in:

2.0.23

Disclosed:

Jul 6, 2026

CVE-2026-10082 on NVD →

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

CVSS:

8.3

Affected:

up to 2.0.21

Fixed in:

2.0.22

Disclosed:

Jun 17, 2026

CVE-2026-54816 on NVD →

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `placement_update_item()` function. This makes it possible for authenticated...

CVSS:

4.3

Affected:

up to 2.0.14

Fixed in:

2.0.15

Disclosed:

Feb 18, 2026

CVE-2025-12884 on NVD →

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authent...

CVSS:

4.9

Affected:

up to 2.0.15

Fixed in:

2.0.16

Disclosed:

Jan 16, 2026

CVE-2025-12984 on NVD →

The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server.

CVSS:

7.2

Affected:

up to 2.0.14

Fixed in:

2.0.15

Disclosed:

Dec 29, 2025

CVE-2025-13592 on NVD →

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions....

CVSS:

7.3

Affected:

up to 2.0.12

Fixed in:

2.0.13

Disclosed:

Oct 31, 2025

CVE-2025-10487 on NVD →

The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placement_slug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin....

CVSS:

7.2

Affected:

up to 1.52.1

Fixed in:

1.52.2

Disclosed:

May 7, 2024

CVE-2024-2290 on NVD →

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVSS:

6.4

Affected:

up to 1.52.1

Fixed in:

1.52.2

Disclosed:

May 7, 2024

CVE-2024-3952 on NVD →

The Advanced Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title parameter in versions up to, and including, 1.31.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject ar...

CVSS:

5.5

Affected:

up to 1.31.1

Fixed in:

1.32.0

Disclosed:

Sep 28, 2022

CVE-2022-32776 on NVD →

The Advanced Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘advads-last-edited-group’ parameter in versions up to, and including, 1.17.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.1

Affected:

up to 1.17.4

Fixed in:

1.17.4

Disclosed:

Mar 18, 2020