What this plugin does

• Slug: ad-inserter
• Author: Spacetime
• 300000+ active installs
• 98/100 rating (2428 reviews on wordpress.org)
• 19179271 all-time downloads
• On WordPress.org since 2010-11-14

ad managerad rotationadsadsenseamp

Maintenance status

• Latest known version: 2.8.18
• Last updated: 2026-07-27 4:42pm GMT
• Tested up to WordPress: 7.0.4
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

15 known CVEs on file for Ad Inserter. Reported between 2015 and 2026.

+ 18 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2023-4645	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.31	Missing Authorization	Medium 5.3	< 2.7.31	2.7.31	2023-09-22	✓ fixed in latest
CVE-2023-1549	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.27	Deserialization of Untrusted Data	High 7.2	< 2.7.27	2.7.27	2023-04-19	✓ fixed in latest
CVE-2022-0901	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.12	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 2.7.12	2.7.12	2022-03-14	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.11	—	Unknown	< 2.7.11	2.7.11	2022-02-03	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.11	—	Unknown	< 2.7.11	2.7.11	2022-02-03	✓ fixed in latest
CVE-2022-0288	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.12	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 2.7.12	2.7.12	2022-01-24	✓ fixed in latest
CVE-2019-15324	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.22	Improper Input Validation	High 8.8	< 2.4.22	2.4.22	2019-07-15	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.22	—	Unknown	< 2.4.22	2.4.22	2019-07-15	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.20	—	Unknown	< 2.4.20	2.4.20	2019-07-13	✓ fixed in latest
CVE-2019-15323	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.4.20	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	High 7.5	< 2.4.20	2.4.20	2019-07-12	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.6	—	Unknown	< 1.5.6	1.5.6	2015-08-13	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.6	—	Unknown	< 1.5.6	1.5.6	2015-08-13	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.3	—	Unknown	< 1.5.3	1.5.3	2015-05-08	✓ fixed in latest
CVE-2015-9497	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.3	Cross-Site Request Forgery (CSRF)	High 8.8	< 1.5.3	1.5.3	2015-05-02	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.7.11	—	Unknown	< 2.7.11	2.7.11	—	✓ fixed in latest
—	Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 1.5.6	—	Unknown	< 1.5.6	1.5.6	—	✓ fixed in latest
—	Ad Inserter <= 1.5.5 - Authenticated Cross-Site Scripting (XSS)	—	Unknown	< 1.5.6	1.5.6	—	✓ fixed in latest
—	Ad Inserter < 2.7.11 - Admin+ RCE / Stored XSS	—	Unknown	< 2.7.11	2.7.11	—	✓ fixed in latest

How to fix it

Keep Ad Inserter updated — 2.8.18 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• Ads.txt Manager — 100000+ active installs — 94/100 (15) — max PHP 8.4
• Advanced Ads – Ad Manager & AdSense — 100000+ active installs — 98/100 (1461)
• AdRotate Banner Manager — 20000+ active installs — 86/100 (655) — max PHP 8.4
• Quads Ads Manager for Google AdSense — 20000+ active installs — 98/100 (1087)
• Quick Adsense — 20000+ active installs — 78/100 (74)