Vulnerabilities

TI-2026-10530 CVE-2026-12242 · GHSA-5gg9-wwjm-frfp

AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute

MEDIUM 42

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00856 Published 2026-06-24 No fix listed CWE-94

TI-2022-01094 CVE-2022-1206 · GHSA-77x6-hmg8-vxg7

AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload

LOW 35

The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all version…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00958 Published 2024-08-20 No fix listed CWE-434

Vulnerabilities

Filters

AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute

AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload