high7.5
CVE-2026-81655
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user und…
Impact
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
Affected products
| Product | Affected versions |
|---|---|
| Ad Inserter WordPress Plugin | before 2.8.19 |
Versions were read from the advisory text. No structured product data has been published for this record yet.