Vulnerability details
CVE-2025-10487
Monetizemore Advanced Ads – Ad Manager & AdSense
Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
CVSS 3.1
7.3High
Official description
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions. This makes it possible for unauthenticated attackers to call arbitrary functions beginning with get_the_ like get_the_excerpt which can make information exposure possible.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.3High | 3.1 | CVEProject cvelistV5 (CNA) (Wordfence) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Monetizemore | Advanced Ads – Ad Manager & AdSense | v ≤ 2.0.12 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-11-01
- Last updated
- 2026-04-08
- State
- Published
- Assigner (CNA)
- Wordfence
Exploit prediction (EPSS)
0.47%
Probability of exploitation in 30 days
40.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')