CVE-2026-102905

37th percentile - higher than 37% of all known CVEs

The Ad Inserter plugin for WordPress (versions up to and including 2.8.19) is vulnerable to arbitrary shortcode execution because it allows users to execute an action without properly validating a value before running do_shortcode. An unauthenticated attacker can execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages.

An unauthenticated attacker can execute arbitrary shortcodes, potentially leading to information disclosure or unwanted actions within the site context. However, this requires a specific plugin configuration by an administrator.

Update the Ad Inserter plugin to a version later than 2.8.19. Review ad block configurations and avoid using dynamic tags on search pages unless necessary.