Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Ajdg Clear all filters
TI-2022-00577 CVE-2022-0662 · GHSA-cw5f-88f5-5m2m

Adrotate < 5.8.23 - Admin+ XSS via Advert Name

Priority LOW 23

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-02 Fixed in 5.8.23 CWE-79
TI-2022-00565 CVE-2022-0649 · GHSA-7vp2-wpmq-r5hv

Adrotate < 5.8.23 - Admin+ XSS via Group Name

Priority LOW 23

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-02 Fixed in 5.8.23 CWE-79
TI-2021-06430 CVE-2021-24138 · GHSA-3g55-69j2-vxv7

AdRotate < 5.8.4 - Authenticated SQL Injection

Priority LOW 27

Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id".

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.01231 Published 2021-03-18 Fixed in 5.8.4 CWE-89