FlatPM – Ad Manager, AdSense and Custom Code

FlatPM – Ad Manager, AdSense and Custom Code has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

Every one of the 3 issues recorded for FlatPM – Ad Manager, AdSense and Custom Code has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. FlatPM – Ad Manager, AdSense and Custom Code is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all FlatPM – Ad Manager, AdSense and Custom Code vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-0690

FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta

Read the full analysis

Vulnerability Records

3 records
FlatPM – Ad Manager, AdSense and Custom Code banner
Latestv3.2.3

FlatPM – Ad Manager, AdSense and Custom Code

Mikhail Flat

Author

Mikhail Flat

4.6(9)
92/100
Last Updated
2026-01-07 (8mo ago)
Active Installs
10,000+
Downloads
186,814
Requires WP
5.9+
Requires PHP
5.6+
Tested up to
WP 6.9.7
Created
2021-03-08 (6y ago)

Flat PM is an ad management plugin. You might be thinking, “why do I need it?”. It’s simple: this is the best plugin for organizing ads at a professional level. From 12.02.2024 completely FREE!!! You can compare it with plugins like Advanced Ads, Ad Inserter, believe me, it’s nothing compared to FlatPM. If you’re worried about front-end performance, then the plugin code is written without using jQuery! Flat PM has all the functionality, with the exception of GEO, completely free. This is a new level of advertising management. You can not only create and save ad blocks, but also divide them into folders. Manage general settings for a folder so that you don’t have to make changes to each individual ad block. You can create 3 different types of AB tests. The plugin has the following options for displaying ads: Output based on pixels or the height of the user’s screen (a completely unique solution that is not found in other plugins); Output based on characters or percentage of your article text; Output once, or with repetitions based on css selectors (you are not limited by the content of your article, works without hooks on the backend, very configurable); Output of pop-ups and leaving blocks on the left/bottom/right and so on, 9 positions in total; Display ads when hovering over an element: images, text, video, and whatever you want; Video preroll before watching videos on YouTube, Vimeo. The plugin does not have any restrictions, it is a fully customizable tool. Content targeting options: Publications; Publication types; Categories and taxonomies; The number of characters and headings in the publication; The authors of the publication; Types of templates and templates. User targeting options: GEO: country or city (paid base of IP addresses is used); referrer; Browser; Operating system; ISP – Internet Service Provider; Get parameter in the link address; Cookies; Date and time; You can specify the schedule by day of the week; The role of the user on the site; user-agent; You can block the display by ip. Additional options: Reloading ads; Fixed Widgets; Laziload advertising; Stylization; Fine-tuning the interface of the plugin itself; Export Import; Output in head and footer; Full compatibility with caching plugins; Auto reset cache when changing ad settings. The plugin has been translated into English, Ukrainian and Russian languages. In the future, translation into German, Spanish, French will be made. You can contact us for help with translation. Conclusion: Flat PM is a professional solution that has been perfected over 7 years. The code is clean, does not create a load on the server. Ease of use in the admin panel. The interface is clear and structured.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C