Executive brief
Advanced Ads is a popular WordPress plugin used to manage and display advertisements on websites. A security flaw allows users with low-level 'Contributor' access to inject malicious scripts into website pages. If an administrator or site visitor views the affected content, these scripts could execute in their browser, potentially leading to unauthorized actions or the theft of administrative session information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Advanced Ads plugin for WordPress due to insufficient sanitization and escaping of the 'ad_args' parameter within the 'the_ad' shortcode. Authenticated attackers with at least the Contributor role can craft a shortcode containing URL-encoded JSON payloads that bypass standard WordPress filters (wp_kses_post). When the shortcode is rendered—such as during a post preview by an Editor or Administrator—the malicious payload is output directly into the HTML. This allows for the execution of arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 2.0.23.
Affected products
- Advanced Ads Advanced Ads – Ad Manager & AdSense < 2.0.23
Timeline
- 2026-07-06: disclosed: Publicly published by WPScan
- 2026-07-27: advisory: CVE published to NVD
- 2026-07-06: patched: Fix available in version 2.0.23