https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 18:25:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-11900 <p><strong>Affected:</strong> spacetime Ad Inserter – Ad Manager &amp; AdSense Ads</p> <p>The Ad Inserter – Ad Manager &amp; AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the &#39;data&#39; attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field(&#39;post_content&#39;, N) without verifying the requesting user&#39;s capability with current_user_can(&#39;read_post&#39;), without restricting the post type to &#39;wp_block&#39;, and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.</p> <p><strong>Affected:</strong> spacetime Ad Inserter – Ad Manager &amp; AdSense Ads</p> <p>The Ad Inserter – Ad Manager &amp; AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the &#39;data&#39; attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field(&#39;post_content&#39;, N) without verifying the requesting user&#39;s capability with current_user_can(&#39;read_post&#39;), without restricting the post type to &#39;wp_block&#39;, and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.</p> https://cve.radiocsirt.org/vuln/cve-2026-11900