Spacetime
Vulnerability activity for Spacetime: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.1HighOct 30, 2026Spacetime Ad Inserter XSSCVE-2026-105077Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
- 6.5MediumOct 30, 2026Spacetime Ad Inserter – Ad Manager & AdSense Ads Code / command injectionCVE-2026-102905The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {c
- 4.3MediumOct 13, 2026Spacetime Ad Inserter – Ad Manager & AdSense Ads Information disclosureCVE-2026-89097The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefix
- 6.1MediumOct 1, 2026Spacetime Ad Inserter – Ad Manager & AdSense Ads XSSCVE-2026-89427The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has configu
- 6.1MediumOct 1, 2026Spacetime Ad Inserter – Ad Manager & AdSense Ads XSSCVE-2026-19902The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the '{search-query}' dynamic tag. When an ad block's code contains that tag, replace_ai_tags() reads $_SERVER['HTTP_REFERER'] and tests it with the regex /[\.\/](google|yahoo|bing|ask)\.[a-z\.]{2,5}[\/]/i. The leading [\.\/] class matches a literal slash, so
- 7.1HighSep 30, 2026Spacetime Ad Inserter XSSCVE-2026-97077Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
- 5.3MediumSep 16, 2026Spacetime Ad Inserter – Ad Manager & AdSense Ads Auth bypass / access controlCVE-2026-11984The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.
Top products
- Ad Inserter – Ad Manager & AdSense Ads5 CVEs in the last year
- Ad Inserter2 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.