spacetime Ad Inserter – Ad Manager & AdSense Ads vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest spacetime Ad Inserter – Ad Manager & AdSense Ads vulnerabilities

CVE-2026-102905 — Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter (CVSS 6.5)
CVE-2026-89097 — Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters (CVSS 4.3)
CVE-2026-89427 — Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter (CVSS 6.1)
CVE-2026-19902 — Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header) (CVSS 6.1)
CVE-2026-11984 — Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter (CVSS 5.3)
CVE-2026-11983 — Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax (CVSS 5.3)
CVE-2026-11900 — Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute (CVSS 4.3)
CVE-2026-9280 — Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode (CVSS 6.1)
CVE-2025-11745 — Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (CVSS 6.4)