CVE-2026-89050

4.3 mediumEPSS 0.1%

Medium (4.3). EPSS 0.1% chance of exploitation in the next 30 days.

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-345
Published: 2026-09-13
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/da063797-1c68-4164-a94b-9e9b628bcd75/

Check your stack JSON