EUVD lists arbitrary shortcode execution in Ad Inserter WordPress plugin (EUVD-2026-114224)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Spacetime
- Product
- Ad Inserter – Ad Manager & AdSense Ads
- First seen
Summary
The EUVD database, as relayed by a Mastodon post, lists an arbitrary shortcode execution flaw in this WordPress plugin, scored 6.5 (CVSS v3.1). The listing says all versions up to and including 2.8.19 are affected.
If you use Spacetime
Update the Ad Inserter plugin to a version later than 2.8.19 once available
Check the EUVD entry EUVD-2026-114224 for vendor guidance
Limit which users can create or edit shortcodes on the site
Update Ad Inserter to a version later than 2.8.19
Check the plugin's changelog or vendor advisory for the fixed release
Review site content and scripts for unexpected injected code
What the sources say 2
· Mastodon: “The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19” Source
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.” Source