CVE-2026-81655: Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ad Inserterto a version that resolves this vulnerability.Fixed in 2.8.19
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be a logged-in WordPress user. A subscriber-level account is sufficient when the relevant Ad Inserter configuration permits access to the affected settings page.
Can this affect users who do not have WordPress accounts?
Yes. Although exploitation requires a logged-in low-privileged user, stored unescaped content may be served to site visitors, exposing them to cross-site scripting.
Is every installation necessarily exposed by default?
The issue is reachable under a configuration that Ad Inserter's own settings allow. The provided information does not establish whether that configuration is enabled by default.