CVE-2026-81655

HIGHCVSS 7.5

Description

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

Timeline

Published:September 27th, 2026 6:16 AM

Last modified:September 28th, 2026 4:38 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/b189ce9a-a930-41e6-bdd1-fdcc3bfb66be/

Source: NIST NVD · Data may lag official sources by up to one minute