CVE-2025-11745: Ad Inserter WordPress Plugin XSS Vulnerability

CVE-2025-11745 Overview

CVE-2025-11745 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress. The flaw affects all plugin versions up to and including 2.8.7. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed through the plugin's adinserter shortcode custom field. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into WordPress pages. The injected script executes in the browser of any visitor who accesses the affected page. The vulnerability is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
Authenticated contributors can persist JavaScript into published WordPress pages, enabling session theft, administrative action hijacking, and client-side redirection against site visitors and editors.

Affected Products

Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress
All versions up to and including 2.8.7
WordPress sites that permit contributor-level account registration or above

Discovery Timeline

2025-11-05 - CVE-2025-11745 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-11745

Vulnerability Analysis

The Ad Inserter plugin exposes the adinserter shortcode, which accepts user-supplied attributes to control ad rendering behavior. The plugin processes these attributes without applying sufficient sanitization or output escaping before writing them back to the rendered page. An authenticated contributor can embed the shortcode inside post or page content and set an attribute value containing HTML or JavaScript payloads. When WordPress renders the shortcode on the front end, the attacker-controlled string is emitted into the DOM intact.

Because the payload persists in the database, every subsequent visit to the affected page triggers execution in the viewer's browser. This includes administrators previewing or moderating the post, which creates a path to session hijacking and privilege abuse. The scope changes from the vulnerable component to the browser context of other users, aligning with the Stored XSS classification under CWE-80.

Root Cause

The root cause is missing sanitization on shortcode attribute values accepted by the Ad Inserter plugin. The code paths involved are documented in the plugin source at ad-inserter.php line 9333 and ad-inserter.php line 9870. The plugin fails to call appropriate escaping functions such as esc_attr() or wp_kses() on the custom field data before output.

Attack Vector

An attacker first obtains contributor-level credentials on the target WordPress site. The attacker then creates or edits a post containing an adinserter shortcode with a malicious attribute payload. Once the post is viewed, either by an administrator in preview or by any site visitor after publication, the script executes in that user's browser session. No user interaction beyond page load is required. See the Wordfence Vulnerability Report for additional analysis.

No verified public exploit code is available at the time of publication. The vulnerability mechanism involves placing a crafted shortcode attribute containing a JavaScript payload into post content, which the plugin then renders unescaped into the HTML output.

Detection Methods for CVE-2025-11745

Indicators of Compromise

Post or page content containing [adinserter ...] shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: strings.
Unexpected outbound requests from site visitor browsers to attacker-controlled domains after loading pages authored by contributor accounts.
New or recently modified posts authored by low-privilege accounts that embed the adinserter shortcode.

Detection Strategies

Query the wp_posts table for post_content entries matching the adinserter shortcode combined with HTML event handlers or script tags.
Review WordPress audit logs for shortcode usage patterns originating from contributor-level accounts.
Scan rendered page HTML for inline scripts that do not match the site's expected content security baseline.

Monitoring Recommendations

Enable a Web Application Firewall rule set that inspects shortcode attribute content for script payloads.
Monitor WordPress user role assignments and track contributor account creation activity.
Alert on administrator session anomalies that follow contributor-authored post previews.

How to Mitigate CVE-2025-11745

Immediate Actions Required

Update the Ad Inserter – Ad Manager & AdSense Ads plugin to a version later than 2.8.7 once the vendor publishes a patched release.
Audit all existing contributor and author accounts and remove any that are unused or unexpected.
Review recently created or edited posts for adinserter shortcode usage with suspicious attribute values and remove malicious content.

Patch Information

At the time of publication, verify current plugin releases on the WordPress plugin repository and apply any version released after 2.8.7. Consult the Wordfence Vulnerability Report for the latest fixed-version information.

Workarounds

Restrict shortcode usage by contributor-level accounts through role management plugins until the patch is applied.
Deploy a Content Security Policy (CSP) that disallows inline script execution on front-end pages.
Temporarily disable the Ad Inserter plugin if updates cannot be applied immediately.
Require editor-level or higher review before publishing content submitted by contributors.

bash

# Example: list posts containing adinserter shortcode via WP-CLI for review
wp db query "SELECT ID, post_author, post_title FROM wp_posts \
  WHERE post_content LIKE '%[adinserter%' \
  AND post_status IN ('publish','pending','draft');"