CVE-2026-89097
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.18 contains a sensitive information exposure vulnerability via ai_wp_footer_hook. This allows authenticated attackers with subscriber-level access and above to extract data such as the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.
Risk Assessment
The risk includes exposure of sensitive technical and configuration data, which can facilitate attacks on the server and application. Exposure of API keys and tokens can lead to unauthorized access to external services.
Recommendation
It is recommended to immediately update the Ad Inserter plugin to the latest version that includes the fix. Also, restrict access to sensitive data and monitor logs for suspicious activity.
Other vulnerabilities in Ad Inserter
See all- CVE-2026-97077High
Unauthenticated XSS attack in Ad Inserter plugin up to version 2.8.18. An attacker can inject malicious script without authentication.
- CVE-2026-107864Medium
Stored XSS vulnerability in the Ad Inserter plugin by Igor Funa. Improper input neutralization during page generation allows persistent script injection.
- CVE-2026-89427Medium
The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the 's' search parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires an ad block with {title} or {short-title} placeholder enabled on search pages.
- CVE-2026-19902Medium
The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the Referer header. Insufficient input sanitization and output escaping on the '{search-query}' dynamic tag allow unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator. Exploitation requires an ad block with the '{search-query}' tag and automatic insertion enabled.
- CVE-2026-81655High
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged-in user under a configuration its own settings allow, and does not filter the content saved there. This allows users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
- CVE-2026-11984Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.
- CVE-2026-11983Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.
- CVE-2026-57693Medium
The Ad Inserter WordPress plugin version 2.8.11 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The flaw allows an attacker to exploit incorrectly configured access control security levels.
Original NVD description (English source)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS