Back to the CVE list

CVE-2026-11984Suited to automated attack · CISA

Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

CVSS score

5.3

EPSS probability

%0.3

Risk score

0.0

Published

1 mo ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

5.3

CVE-2026-11983Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax

Vendorspacetime ProductAd Inserter – Ad Manager & AdSense Ads

Patch status unknownEPSS %02 mo ago

6.1

CVE-2026-19902Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

Vendorspacetime ProductAd Inserter – Ad Manager & AdSense Ads

Patch status unknownEPSS %019 d ago

6.1

CVE-2026-89427Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter

Vendorspacetime ProductAd Inserter – Ad Manager & AdSense Ads

Patch status unknownEPSS %019 d ago

7.1

CVE-2026-97077WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Vendorspacetime ProductAd Inserter

Patch status unknownEPSS %020 d ago

4.3

CVE-2026-89097Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters

Vendorspacetime ProductAd Inserter – Ad Manager & AdSense Ads

Patch status unknownEPSS %07 days ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-11984"