What is GHSA-xfh3-8f49-737f?

GHSA-xfh3-8f49-737f is a security advisory published by GitHub Security Advisories with Medium severity. The Ad Inserter – Ad Manager \u0026 AdSense Ads plugin for WordPress is vulnerable to authorization...

Which CVE IDs does GHSA-xfh3-8f49-737f cover?

GHSA-xfh3-8f49-737f covers the following CVE IDs: CVE-2026-11984. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xfh3-8f49-737f?

GHSA-xfh3-8f49-737f has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-xfh3-8f49-737fMediumCVSS 5.3

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-11984 →

📋 Description

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-11984
https://plugins.trac.wordpress.org/changeset/3583409/ad-inserter/trunk/ad-inserter.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/95bc1aa4-f517-4921-99c4-f8fe071eafd9?source=cve
https://github.com/advisories/GHSA-xfh3-8f49-737f