CVE-2026-25366 - WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability

Back Back to CVE browser

CRITICAL

WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability

Published Mar 25, 2026

9.9

CRITICAL

CVSS 3.1

EPSS 0.31%

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.

Affected products

Vendor Themeisle Product Woody ad snippets Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=2.7.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Themeisle

Woody ad snippets

unaffected

Version	Status	Constraints
0	affected	<=2.7.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-15689		Advisory
https://patchstack.com/database/Wordpress/Plugin/insert-php/vulnerability/wordpress-woody-ad-snippets-plugin-2-7-1-remote-code-execution-rce-vulnerability?_s_id=cve		vdb-entry