adrotateplugin vulnerabilities

Products

• adrotate 2

Latest adrotateplugin CVEs

Newest publication first

1. CVE-2014-1854 AdRotate – Ad manager & AdSense Ads 3.9 - 3.9.4 - SQL Injection

   Published 2014-02-27

   High·CVSS 7.5 EPSS 5.7% Public exploit

   SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.

2. CVE-2011-4671 AdRotate – Ad manager & AdSense Ads < 3.6.8 - SQL Injection

   Published 2011-12-02

   High·CVSS 7.5 EPSS 2.8% Public exploit

   SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.