https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T12:46:30.434998+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-81655 CVE-2026-81655 — Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields 2026-10-04T12:46:30.701769+00:00

Affected: Unknown Ad Inserter

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.