CVE-2026-81655

7.5 Élevée

Publiée le 27/09/2026 à 08:16 · Modifiée le 28/09/2026 à 18:38 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

Traduire en français

Produits concernés

Unknown Ad Inserter

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94

Références

https://wpscan.com/vulnerability/b189ce9a-a930-41e6-bdd1-fdcc3bfb66be/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories