Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · adrotate
AdRotate
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 24, 2026AdRotate Banner Manager: PHP Code InjectionCVE-2026-12242 · affects up to 5.17.7 · reported by WordfenceHigh 8.8
The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server. This vulnerability requires W3 Total Cache or Borlabs Cache support to be enabled in AdRotate settings.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2024AdRotate Banner Manager – The only ad manager you'll need: Arbitrary file uploadsCVE-2022-1206 · affects up to 5.13.2 · reported by WordfenceHigh 7.2
The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 30, 2022Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.CVE-2022-26366 · affects up to 5.9 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.
May 2, 2022AdRotate: Does not sanitise and escape Advert NamesCVE-2022-0662 · fixed in 5.8.23 · reported by WPScanMedium 4.8
The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
May 2, 2022AdRotate: Does not escape Group NamesCVE-2022-0649 · fixed in 5.8.23 · reported by WPScanMedium 4.8
The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Mar 7, 2022AdRotate: Does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to adminsCVE-2022-0267 · fixed in 5.8.22 · reported by WPScanHigh 7.2
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
Mar 18, 2021Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id".CVE-2021-24138 · fixed in 5.8.4 · reported by WPScanMedium 5.5
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.
Dec 2, 2011adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for: SQL injectionCVE-2011-4671 · fixed in 3.6.8 · reported by MITREHigh 7.5
SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.