Ad Inserter – Ad Manager & AdSense Ads

Ad Inserter – Ad Manager & AdSense Ads has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 17 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (41%). Other recurring categories include Missing Authorization, Code Injection.

Every one of the 17 issues recorded for Ad Inserter – Ad Manager & AdSense Ads has a vendor fix available, so running the current release closes all known holes.

16 independent researchers contributed these findings, most of them (2) reported by Marco Wotschka. Ad Inserter – Ad Manager & AdSense Ads is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

01234567891014.11.2010Today02.05.20158.8Ad Inserter – Ad Manager & AdSense Ads < 1.5.3 - Cross-Site Request Forgery to Cross-Site Scripting CVSS 8.8 · 02.05.201513.08.20154.8Ad Inserter <= 1.5.5 - Cross-Site Request Forgery to Cross-Site Scripting CVSS 4.8 · 13.08.201512.07.20197.5Ad Inserter <= 2.4.19 - Authenticated Path Traversal CVSS 7.5 · 12.07.201915.07.20198.8Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution CVSS 8.8 · 15.07.201924.01.20226.1Ad Inserter <= 2.7.9 - Reflected Cross-Site Scripting CVSS 6.1 · 24.01.202203.02.20227.2Ad Inserter < 2.7.11 - Authenticated (Admin+) Remote Code Execution CVSS 7.2 · 03.02.202207.04.20226.1Ad Inserter Free and Pro <= 2.7.11 - Reflected Cross-Site Scripting CVSS 6.1 · 07.04.202219.04.20237.2Ad Inserter <= 2.7.25 - Authenticated (Admin+) PHP Object Injection CVSS 7.2 · 19.04.202322.09.20235.3Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax CVSS 5.3 · 22.09.20235.3Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe CVSS 5.3 · 22.09.202314.10.20246.1Ad Inserter <= 2.7.37 - Reflected Cross-Site Scripting CVSS 6.1 · 14.10.202405.03.20256.1Ad Inserter - Ad Manager and AdSense Ads <= 2.8.0 - Reflected Cross-Site Scripting CVSS 6.1 · 05.03.202504.11.20256.4Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVSS 6.4 · 04.11.202505.06.20266.1Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode CVSS 6.1 · 05.06.202602.07.20264.3Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute CVSS 4.3 · 02.07.202608.07.20266.4Ad Inserter – Ad Manager & AdSense Ads <= 2.8.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 08.07.202605.08.20265.3Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax CVSS 5.3 · 05.08.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

17

Get automatic notifications for all Ad Inserter – Ad Manager & AdSense Ads vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2019-15324

Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution

Read the full analysis

Vulnerability Records

17 records
2026-08-05 22:18CVE-2026-11983
5.3
Medium
AlexHenryYes
2026-07-08 00:00CVE-2026-57693
6.4
Medium
timomangcutYes
2026-07-02 19:01CVE-2026-11900
4.3
Medium
nightwardYes
2026-06-05 14:15CVE-2026-9280
6.1
Medium
normaandersonfrankYes
2025-11-04 21:29CVE-2025-11745
6.4
Medium
Muhammad Yudha - DJYes
2025-03-05 00:00CVE-2025-22623
6.1
Medium
Andres RoldanYes
2024-10-14 00:00CVE-2024-49248
6.1
Medium
Rafie MuhammadYes
2023-09-22 00:00CVE-2023-4645
5.3
Medium
Marco WotschkaYes
2023-09-22 00:00CVE-2023-4668
5.3
Medium
Marco WotschkaYes
2023-04-19 00:00CVE-2023-1549
7.2
High
Nguyen Huu DoYes
Showing 1–10 of 17 reports
Ad Inserter – Ad Manager & AdSense Ads banner
Latestv2.8.18

Ad Inserter – Ad Manager & AdSense Ads

Spacetime

Author

Spacetime

4.9(2,428)
98/100
Last Updated
2026-07-27 (2mo ago)
Active Installs
300,000+
Downloads
19,207,743
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2010-11-14 (16y ago)

Ad management plugin with many advanced advertising features to insert ad codes at optimal positions. Supports all kinds of ads including Google AdSense, Google Ad Manager (DFP – DoubleClick for publishers), Media.net , Infolinks and rotating banners. This plugin is more than AdSense plugin or plugin for ads. It provides many advanced options to insert opt-in forms, header scripts, Javascript, CSS, HTML, PHP, analytics, tracking or advert code anywhere on the page. Insert ads where other plugins fail. It’s all about the settings. Plugin reviews: I’ve been using another ad placement manager for a couple years and just recently started using Ad Inserter. I’m blown AWAY with the power and flexibility of it. I can HIGHLY recommend this plugin to anyone looking for an easy way to manage ads within WordPress. Difficult to choose, but certainly top 3 plugins I’ve ever used in WordPress, ever. Features – check documentation for the complete list AdSense integration Support for Google Ad Manager (DoubleClick for publishers) Syntax highlighting editor Plain JavaScript code on front-end – no library dependencies Code preview with visual CSS editor Automatically inserts ads on posts and pages Insert before or after post Insert before or after content Insert before or after paragraph Insert before or after random paragraph Insert before or after multiple paragraphs Insert before or after image Insert before or after comments Insert before or after excerpt Insert near any element on the page (using CSS selectors) Insert above the header (after <body> tag) Insert in the footer (before </body> tag) Insert at relative positions in posts Insert between posts on blog pages (in-feed AdSense) Insert between excerpts on blog pages Insert between comments Insert at custom hook positions (do_action () WP function) Insert before or after any HTML element using CSS selectors Visual HTML element selector (DOM explorer) Avoid inserting ads near images or headers (AdSense TOS) Disable ads on individual posts or pages Insert header (<head> section) and footer code Insert raw HTTP response header lines Insert Google Analytics, Matomo (Piwik) or any other tracking code Insert images, HTML, CSS, Javascript or PHP code Insert into Ajax, RSS and REST requests Insert with Gutenbeg blocks Code generator for banners and placeholders AdSense code generator Support to detect, hide or replace blank AdSense blocks Visual advert editor – create adverts from scratch Manual insertion: widgets, shortcodes, PHP function call Sticky (fixed) widgets (sticky sidebar – the sidebar does not move when the page is scrolled) Custom alignments and styles Insert different ad codes on AMP pages Custom CSS class name for wrapping divs to avoid ad blockers Use shortcodes from other plugins Use custom fields as defined in posts Use post title, tags or category names to create contextual adverts PHP code processing Ad labels – show customized label above adverts ads.txt editor Global custom fields Support for GDPR consent checks Support for IAB TCF 2.0 GDPR consent API (used by Quantcast Choice) Ad rotation (server-side and client-side – works with caching) Timed ad rotation – define times to rotate adverts in a single ad block Create rich media ads with standard WordPress TinyMCE editor Ad blocking detection – popup message, page redirection Desktop/mobile device detection (server-side and client-side – works with caching) Blacklist/Whitelist categories, tags, taxonomies, post IDs, urls, url query parameters, cookies, referrers, browsers, operating systems Easy copying and pasting ads or settings using internal clipboard Use it with Google Site Kit or replace it to have more control over ad placement Simple troubleshooting with many debugging functions Function to visualize inserted blocks Function to visualize AdSense ads with ad names and IDs Function to visualize available insertion positions Function to visualize HTML tags You name it 🙂 Review on WP Mayor The Best WordPress Ad Management Plugin? Review on ShoutMeLoud Both Google and Amazon recommend this plugin for inserting ads, which is a testament to its quality Endorsed by Google – How to insert ad code in your WordPress site If you’re new to AdSense, one of your first tasks is to connect your site to AdSense. This requires you to copy the code on your AdSense homepage and paste it into the HTML of your page, between the <head> and </head> tags. 👉 Pro version supports additional advanced features: Geolocation using internal or MaxMind databases (works also with caching) Country, state, region and city level geotargeting Blacklist/Whitelist IP addresses or countries/cities (works also with caching) Ad impression and click statistics (works also with <iframe> Javascript ads like Google AdSense) Statistics reports for clients in PDF format or public web pages External tracking via Google Analytics or Matomo (Piwik) A/B testing – discover adverts and settings that perform best Frequency capping – limit impressions or clicks Click fraud protection reCaptcha v3 score check to hide ads from invalid traffic Delayed loading of ad scripts until user interacts with the website Lazy loading – delayed loading of ad scripts until the page is scrolled Sticky ads with optional close button Sticky sidebar ads (stick to the screen or to the content) Floating slide-in banner adverts Sticky (floating) ads with animations (fade, slide, turn, flip, zoom) Animation trigger for sticky ads (page scroll in % or px, HTML element becomes visible) background ads (skin ads) Parallax ads Support for sticky ad bar Support for scheduling date and time with fallback option Support to show ads as soon as the GDPR consent is given Support for ads in iframes Anti ad blocking features – replace ads, protect content Ad blocking statistics Multisite options to limit settings on the sites Individual post/page exception management Export and import of settings Support via email Run a WordPress related blog? Have experience with AdSense? Interested in reviewing the plugin or would like to become an affiliate? Introduce yourself. Have experience with WordPress theme or plugin translation? We are looking for translators! Contact us. Check documentation pages for detailed description of all the features and some common settings for quick start. You can also use shortcodes from other plugins (for example, to insert content from other plugins). Looking for AdSense plugin with simple setup for ads at best positions? Ad Inserter can insert ads where other plugins fail. It’s all about the settings. Average Rating: 5 out of 5 stars – check Ad Inserter reviews One of the best adsense plugins … Most comprehensive Ad plugin available … Better than the old Google adsense plugin … The best WP Ad management plugin … Very flexible and excellent documentation … Excellent Ad Plugin … Easy to use and also does more than I need … Exactly what I needed to sell advertising spots … Awesome Plugin and Super Support! … Lots of options and easy to use … Crazy flexible … Great plugin that makes it simple … Superb Plugin and Support team also so good … Best in same kind of plugins … Must Have Plugin for Each WP Site … Best Ad Placement Plugin … Best Solution for Advertisement Management … Comprehensive, flexible and well supported … God bless these guys! … PRO for Free … Please support plugin development Support the advancement of this plugin: Rate it – positive ratings and reviews are a great way to show your appreciation for my work. Besides being an incredible boost to my morale, they are also a great incentive to fix any bug found in the software and to add new features for better monetization of your website. Donate if Ad Inserter helps you to make money with advertising Register for Ad Inserter Pro Affiliate, promote the plugin on your website and earn commission for each purchase you refer Buy license for Ad Inserter Pro

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C