Is my WordPress plugin safe?

Not this one?Advanced Adsadvanced-ads-tracking

• Oct 2, 2026Advanced Ads: Authorization Bypass Through User-Controlled KeyCVE-2026-94180 · affects up to 2.0.26 · reported by PatchstackMedium 4.3

  Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.

  NVD recordpatchstack.com

• Jul 27, 2026Advanced Ads: Does not sanitize and escape a shortcode parameter before outputting it in the pageCVE-2026-10082 · fixed in 2.0.23 · reported by WPScanMedium 6.1

  The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.

  NVD recordwpscan.com

• Jun 17, 2026Advanced Ads: Improper Control of Generation of Code ('Code Injection')CVE-2026-54816 · affects up to 2.0.21 · reported by PatchstackHigh 7.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21.

  NVD recordpatchstack.com

• Feb 19, 2026Advanced Ads – Ad Manager & AdSense: Authorization bypassCVE-2025-12884 · affects up to 2.0.14 · reported by WordfenceMedium 4.3

  The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `placement_update_item()` function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update ad placements, allowing them to change which ad or ad group a placement serves.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 17, 2026Advanced Ads – Ad Manager & AdSense: SQL InjectionCVE-2025-12984 · affects up to 2.0.15 · reported by WordfenceMedium 4.9

  The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 29, 2025Advanced Ads: Remote Code ExecutionCVE-2025-13592 · affects up to 2.0.14 · reported by WordfenceHigh 7.2

  The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 1, 2025Advanced Ads – Ad Manager & AdSense: Remote Code ExecutionCVE-2025-10487 · affects up to 2.0.12 · reported by WordfenceHigh 7.3

  The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions. This makes it possible for unauthenticated attackers to call arbitrary functions beginning with get_the_ like get_the_excerpt which can make information exposure possible.

  NVD recordplugins.trac.wordpress.orgwordfence.com

• May 14, 2024Advanced Ads – Ad Manager & AdSense: Stored Cross-Site ScriptingCVE-2024-3952 · affects up to 1.52.1 · reported by WordfenceMedium 6.4

  The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 14, 2024Advanced Ads: PHP Object InjectionCVE-2024-2290 · affects up to 1.52.1 · reported by WordfenceHigh 7.2

  The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placement_slug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 8, 2022Auth.CVE-2022-32776 · affects up to 1.31.1 · reported by PatchstackMedium 4.8

  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress.

  NVD recordpatchstack.comwordpress.org

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.