CVE-2025-10487: high-severity vulnerability in monetizemore Advanced Ads – Ad Manager & AdSense
Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.5%
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions. This makes it possible for unauthenticated attackers to call arbitrary functions beginning with get_the_ like get_the_excerpt which can make information exposure possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
monetizemore · Advanced Ads – Ad Manager & AdSenseRelated CVEs — monetizemore Advanced Ads – Ad Manager & AdSense
In the same product, most dangerous first.
CVE-2024-2290HIGHAdvanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object InjectionEPSS 0.9%CVE-2025-13592HIGHAdvanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via ShortcodeEPSS 0.9%CVE-2024-3952MEDIUMAdvanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad WidgetEPSS 0.4%CVE-2025-12984MEDIUMAdvanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL InjectionEPSS 0.4%CVE-2025-12884MEDIUMAdvanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements UpdateEPSS 0.3%