Quick Adsense Reloaded Vulnerabilities

The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.0.3

Fixed in:

3.0.4

Disclosed:

Jun 29, 2026

CVE-2026-57335 on NVD →

The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 3.0.3

Fixed in:

3.0.4

Disclosed:

Jun 17, 2026

CVE-2026-54824 on NVD →

The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.0.2

Fixed in:

3.0.3

Disclosed:

May 28, 2026

CVE-2026-42744 on NVD →

The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.0.2

Fixed in:

3.0.3

Disclosed:

May 24, 2026

CVE-2026-42732 on NVD →

Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters vulnerability

CVSS:

6.5

Affected:

up to 2.0.98.1

Fixed in:

2.0.99

Disclosed:

Mar 28, 2026

The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.98.1 due to insufficient input sanitization and output escaping of multiple ad metadata parameters. This makes it possible for authenticated attackers, with Contributor-level...

CVSS:

5.4

Affected:

up to 2.0.98.1

Fixed in:

2.0.99

Disclosed:

Mar 27, 2026

CVE-2026-2595 on NVD →

The Ads by WPQuads plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.0.87.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queri...

CVSS:

7.5

Affected:

up to 2.0.87.1

Fixed in:

2.0.88

Disclosed:

Mar 27, 2025

CVE-2025-30876 on NVD →

The Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.87.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.0.87.1

Fixed in:

2.0.88

Disclosed:

Mar 27, 2025

CVE-2025-30855 on NVD →

The Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the quads_send_feedback() function in versions up to, and including, 2.0.84. This makes it possible for authenticated attackers, with subscriber-level access and above,...

CVSS:

4.3

Affected:

up to 2.0.84

Fixed in:

2.0.85

Disclosed:

Sep 25, 2024

CVE-2024-47317 on NVD →