PLUGIN SECURITY
Is Ad Inserter safe?
Manage Google AdSense ads, banners, ad rotation, sticky widgets, AMP ads, ads.txt, tracking, header and footer code, PHP code, global custom fields
What this plugin does
- Slug:
ad-inserter - Author: Spacetime
- 300000+ active installs
- 98/100 rating (2431 reviews on wordpress.org)
- 19375157 all-time downloads
- On WordPress.org since 2010-11-14
ad managerad rotationadsadsenseamp
Maintenance status
- Latest known version: 2.8.18
- Last updated: 2026-09-23 6:41pm GMT
- Tested up to WordPress: 7.0.7
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
23 known CVEs on file for Ad Inserter. Reported between 2015 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-114194 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.19 | — | Medium 6.5 | < 2.8.19 | 2.8.19 | 2026-10-24 | ⚠ update needed |
| CVE-2026-107864 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.19 | — | Medium 6.5 | < 2.8.19 | 2.8.19 | 2026-10-12 | ⚠ update needed |
| CVE-2026-19902 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.8.19 | 2.8.19 | 2026-09-30 | ⚠ update needed |
| CVE-2026-89427 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.8.19 | 2.8.19 | 2026-09-30 | ⚠ update needed |
| CVE-2026-97077 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.8.19 | 2.8.19 | 2026-09-30 | ⚠ update needed |
| CVE-2026-89097 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.19 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 2.8.19 | 2.8.19 | 2026-09-30 | ⚠ update needed |
| CVE-2026-81655 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] >= 2.8.12 - < 2.8.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | 2.8.12–2.8.19 | 2.8.19 | 2026-09-27 | ⚠ update needed |
| CVE-2026-11983 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.17 | Missing Authorization | Medium 5.3 | < 2.8.17 | 2.8.17 | 2026-08-05 | ✓ fixed in latest |
+ 26 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-11984 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.17 | Missing Authorization | Medium 5.3 | < 2.8.17 | 2.8.17 | 2026-08-05 | ✓ fixed in latest |
| CVE-2026-57693 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.12 | — | Medium 6.5 | < 2.8.12 | 2.8.12 | 2026-07-08 | ✓ fixed in latest |
| CVE-2026-11900 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.17 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 2.8.17 | 2.8.17 | 2026-07-02 | ✓ fixed in latest |
| CVE-2026-9280 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.8.16 | 2.8.16 | 2026-06-05 | ✓ fixed in latest |
| CVE-2025-11745 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.8 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 6.4 | < 2.8.8 | 2.8.8 | 2025-11-04 | ✓ fixed in latest |
| CVE-2025-22623 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.8.1 | 2.8.1 | 2025-03-05 | ✓ fixed in latest |
| CVE-2024-49248 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.38 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.7.38 | 2.7.38 | 2024-10-14 | ✓ fixed in latest |
| CVE-2023-4668 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.31 | Missing Authorization | High 7.5 | < 2.7.31 | 2.7.31 | 2023-09-22 | ✓ fixed in latest |
| CVE-2023-4645 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.31 | Missing Authorization | Medium 5.3 | < 2.7.31 | 2.7.31 | 2023-09-22 | ✓ fixed in latest |
| CVE-2023-1549 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.27 | Deserialization of Untrusted Data | High 7.2 | < 2.7.27 | 2.7.27 | 2023-04-19 | ✓ fixed in latest |
| CVE-2022-0901 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.7.12 | 2.7.12 | 2022-03-14 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.11 | — | Unknown | < 2.7.11 | 2.7.11 | 2022-02-03 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.11 | — | Unknown | < 2.7.11 | 2.7.11 | 2022-02-03 | ✓ fixed in latest |
| CVE-2022-0288 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.7.12 | 2.7.12 | 2022-01-24 | ✓ fixed in latest |
| CVE-2019-15324 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.22 | Improper Input Validation | High 8.8 | < 2.4.22 | 2.4.22 | 2019-07-15 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.22 | — | Unknown | < 2.4.22 | 2.4.22 | 2019-07-15 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.20 | — | Unknown | < 2.4.20 | 2.4.20 | 2019-07-13 | ✓ fixed in latest |
| CVE-2019-15323 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 2.4.20 | 2.4.20 | 2019-07-12 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.6 | — | Unknown | < 1.5.6 | 1.5.6 | 2015-08-13 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.6 | — | Unknown | < 1.5.6 | 1.5.6 | 2015-08-13 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.3 | — | Unknown | < 1.5.3 | 1.5.3 | 2015-05-08 | ✓ fixed in latest |
| CVE-2015-9497 | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.3 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.5.3 | 1.5.3 | 2015-05-02 | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.11 | — | Unknown | < 2.7.11 | 2.7.11 | — | ✓ fixed in latest |
| — | Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.6 | — | Unknown | < 1.5.6 | 1.5.6 | — | ✓ fixed in latest |
| — | Ad Inserter <= 1.5.5 - Authenticated Cross-Site Scripting (XSS) | — | Unknown | < 1.5.6 | 1.5.6 | — | ✓ fixed in latest |
| — | Ad Inserter < 2.7.11 - Admin+ RCE / Stored XSS | — | Unknown | < 2.7.11 | 2.7.11 | — | ✓ fixed in latest |
How to fix it
Keep Ad Inserter updated — 2.8.18 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Ads.txt Manager — 100000+ active installs — 94/100 (15) — max PHP 8.4
- Advanced Ads – Ad Manager & AdSense — 100000+ active installs — 98/100 (1463) — max PHP 8.4
- AdRotate Banner Manager — 20000+ active installs — 86/100 (655) — max PHP 8.4
- Quads Ads Manager for Google AdSense — 20000+ active installs — 98/100 (1087)
- Quick Adsense — 20000+ active installs — 78/100 (74)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.