Threats tagged 'ghsa-76hf-r86r-7ch3'

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress versions up to and including 2.8.19 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, enabling arbitrary shortcode execution. Exploitation requires an administrator to have configured an ad block with dynamic tags such as {title}, {tag}, {category}, or {smart-tag} displayed on search pages, which is a normal plugin configuration.