The Ads by WPQuads plugin suffers from improper validation of the quantity parameter in input data, allowing an attacker to manipulate values and alter the plugin’s configuration or content behavior. This flaw is an instance of the input validation weakness described by CWE‑1284.

WordPress sites that have installed the Ads by WPQuads quick‑adsense‑reloaded plugin at any version up to and including 3.0.2. The affected product is the Ads by WPQuads plugin as listed by the vendor.

The vulnerability carries a moderate CVSS score of 6.5. The EPSS score is not available and the issue is not listed in CISA KEV. The likely attack vector is remote, through crafted requests sent to the plugin’s web interface. An attacker could change the quantity setting and thereby alter content displayed to visitors or modify advertiser configuration settings, causing incorrect or malicious advertisements to be shown. The overall risk remains moderate until an official patch is applied.