Cm Ad Changer Vulnerabilities

The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the cmac_campaigns_action function. This makes it possible for unauthenticat...

CVSS:

4.3

Affected:

up to 2.0.7

Fixed in:

2.0.8

Disclosed:

May 26, 2026

CVE-2026-9236 on NVD →

The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to per...

CVSS:

4.3

Affected:

up to 2.0.5

Fixed in:

2.0.6

Disclosed:

Apr 22, 2025

CVE-2025-46245 on NVD →

The CM Ad Changer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Banner Title field in versions up to, and including, 1.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execu...

CVSS:

8.8

Affected:

up to 1.7.7

Fixed in:

1.7.8

Disclosed:

Jun 9, 2016

The CM Ad Changer plugin for WordPress is vulnerable to Cross-Site Scripting via several parameters in versions before 1.7.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

5.5

Affected:

up to 1.7.6

Fixed in:

1.7.6

Disclosed:

Apr 21, 2016