CVE-2026-10082

MediumCVSS 6.1

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

The Advanced Ads WordPress plugin before version 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page. This allows users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.

Risk Assessment

An attacker with low privileges can inject a malicious script that executes in administrators' browsers, leading to session theft, account takeover, or further attacks on the site.

Recommendation

Update the Advanced Ads plugin to version 2.0.23 or later, which includes proper script injection protections.

Other vulnerabilities in Advanced Ads

CVE-2026-94180Medium
The Advanced Ads plugin (up to version 2.0.26) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

Original NVD description (English source)

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS