WordPress plugin
AdRotate Banner Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High6
- Medium2
- Low0
All AdRotate Banner Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute ≤5.17.7Update to 5.17.8 | CVE-2026-12242 | |
| High7.2 | Authenticated (Admin+) Double Extension Arbitrary File Upload ≤5.13.2Update to 5.13.3 | CVE-2022-1206 | |
| High8.8 | Cross-Site Request Forgery ≤5.9Update to 5.9.1 | CVE-2022-26366 | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via Group Names <5.8.23Update to 5.8.23 | CVE-2022-0649 | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via Advert Names <5.8.23Update to 5.8.23 | CVE-2022-0662 | |
| High7.2 | Admin+ SQL Injection ≤5.8.17Update to 5.8.22 | CVE-2022-0267 | |
| High7.2 | Authenticated SQL Injection <5.8.4Update to 5.8.4 | CVE-2021-24138 | |
| High7.2 | Authenticated SQL Injection ≤5.2Update to 5.3 | CVE-2019-13570 | |
| Critical9.8 | 3.9.4 - SQL Injection 3.9 – 3.9.4Update to 3.9.5 | CVE-2014-1854 | |
| Critical9.8 | SQL Injection <3.6.8Update to 3.6.8 | CVE-2011-4671 |
- High8.8Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute
≤5.17.7Update to 5.17.8
- High7.2Authenticated (Admin+) Double Extension Arbitrary File Upload
≤5.13.2Update to 5.13.3
- High8.8Cross-Site Request Forgery
≤5.9Update to 5.9.1
- Medium5.5Authenticated Stored Cross-Site Scripting via Group Names
<5.8.23Update to 5.8.23
- Medium5.5Authenticated Stored Cross-Site Scripting via Advert Names
<5.8.23Update to 5.8.23
- High7.2Admin+ SQL Injection
≤5.8.17Update to 5.8.22
- High7.2Authenticated SQL Injection
<5.8.4Update to 5.8.4
- High7.2Authenticated SQL Injection
≤5.2Update to 5.3
- Critical9.83.9.4 - SQL Injection
3.9 – 3.9.4Update to 3.9.5
- Critical9.8SQL Injection
<3.6.8Update to 3.6.8
AdRotate Banner Manager: common questions
Does AdRotate Banner Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in AdRotate Banner Manager: 2 critical, 6 high, 2 medium. None are known to affect version null.
How do I check which version of AdRotate Banner Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent AdRotate Banner Manager vulnerability?
CVE-2026-12242, published Jun 23, 2026: AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute. Severity: High (CVSS 8.8).
Is any AdRotate Banner Manager vulnerability listed in CISA KEV?
No. None of the known AdRotate Banner Manager vulnerabilities is currently listed in the CISA KEV catalog.