The Ad Inserter WordPress plugin version 2.8.19 and earlier contains a validation flaw that allows an unauthenticated attacker to trigger the internal do_shortcode routine with arbitrary parameters. The flaw originates when the plugin processes the 's' search parameter without proper sanitization, permitting the injection of any shortcode payload. Because shortcodes can contain executable PHP, successful exploitation effectively grants the attacker the ability to run arbitrary code on the site, which can compromise confidentiality, integrity, and availability. This vulnerability is classified as CWE‑94.

This flaw affects WordPress installations that include the Ad Inserter – Ad Manager & AdSense Ads plugin with a version of 2.8.19 or earlier. The vulnerability is exploitable only when an administrator has configured an ad block that contains a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} and has that ad block enabled on search pages – a configuration that is commonly used in practice. Sites that have removed or upgraded the plugin, or that never used these dynamic tags on search pages, are not impacted.

The CVSS score of 6.5 represents medium severity, reflecting an unauthenticated attack with significant impact if the attacker can influence shortcode execution. No EPSS score is available to gauge real‑world exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been reported. Attackers would attempt to hit a site's search page, leveraging the search parameter to inject the malicious shortcode. Because no credentials are required, the risk persists until the plugin is patched or the vulnerable configuration is removed.