Code Injection Vulnerability in Woody Ad Snippets Plugin by Themeisle
CVE-2026-25366

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Woody Ad Snippets
Vendor
CVE Published:
25 March 2026

What is CVE-2026-25366?

A code injection vulnerability exists in the Woody Ad Snippets Plugin developed by Themeisle, impacting versions up to 2.7.1. This flaw allows unauthorized code execution, potentially enabling an attacker to inject malicious code into the application. Users of the plugin should take immediate action to secure their installations by updating to the latest version to mitigate the risk of exploitation.

Affected Version(s)

Woody ad snippets 0 <= 2.7.1

References

https://patchstack.com/database/Wordpress/Plugin/insert-p...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Ba Khanh | Patchstack Bug Bounty Program
.