Plugin security history

AdRotate Banner Manager Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with AdRotate Banner Manager, published between 2011 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

2Critical

6High

2Medium

0Low

0Informational

10Patched records

0Currently marked unpatched

2011-11-08First disclosure

2026-06-23Latest disclosure

10 of 10CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2011	1	1 records
2014	1	1 records
2019	1	1 records
2020	1	1 records
2022	4	4 records
2024	1	1 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	2	20%
High	6	60%
Medium	2	20%

Vulnerability-Type Breakdown

SQL Injection

5 records50%

First: 2011. Latest: 2022.

Cross-Site Scripting

2 records20%

First: 2022. Latest: 2022.

CSRF

1 record10%

First: 2022. Latest: 2022.

Arbitrary File Upload

1 record10%

First: 2024. Latest: 2024.

Other

1 record10%

First: 2026. Latest: 2026.

Patch Status

Patched: 10
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.17.8
5.13.3
5.9.1
5.8.23
5.8.22
5.8.4
5.3
3.9.5
3.6.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.17.7`	AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute	June 23, 2026	5.17.8	High
`*-5.13.2`	AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload	August 19, 2024	5.13.3	High
`*-5.9`	AdRotate Banner Manager <= 5.9 - Cross-Site Request Forgery	November 11, 2022	5.9.1	High
`[*, 5.8.23)`	AdRotate – Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Advert Names	April 11, 2022	5.8.23	Medium
`[*, 5.8.23)`	AdRotate – Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Group Names	April 11, 2022	5.8.23	Medium
`*-5.8.17`	AdRotate – Ad manager & AdSense Ads <= 5.8.17 - Admin+ SQL Injection	February 7, 2022	5.8.22	High
`[*, 5.8.4)`	AdRotate < 5.8.4 - Authenticated SQL Injection	June 3, 2020	5.8.4	High
`*-5.2`	AdRotate – Ad manager & AdSense Ads <= 5.2 - Authenticated SQL Injection	July 11, 2019	5.3	High
`3.9-3.9.4`	AdRotate – Ad manager & AdSense Ads 3.9 - 3.9.4 - SQL Injection	February 22, 2014	3.9.5	Critical
`[*, 3.6.8)`	AdRotate – Ad manager & AdSense Ads < 3.6.8 - SQL Injection	November 8, 2011	3.6.8	Critical

Selected source records

Latest Records

HighCVE-2026-12242

AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute

Published: June 23, 2026

Affected versions: *-5.17.7
Patched versions: 5.17.8

Original Wordfence record

HighCVE-2022-1206

AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload

Published: August 19, 2024

Affected versions: *-5.13.2
Patched versions: 5.13.3

Original Wordfence record

HighCVE-2022-26366

AdRotate Banner Manager <= 5.9 - Cross-Site Request Forgery

Published: November 11, 2022

Affected versions: *-5.9
Patched versions: 5.9.1

Original Wordfence record

MediumCVE-2022-0649

AdRotate – Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Group Names

Published: April 11, 2022

Affected versions: [*, 5.8.23)
Patched versions: 5.8.23

Original Wordfence record

MediumCVE-2022-0662

AdRotate – Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Advert Names

Published: April 11, 2022

Affected versions: [*, 5.8.23)
Patched versions: 5.8.23

Original Wordfence record

HighCVE-2022-0267

AdRotate – Ad manager & AdSense Ads <= 5.8.17 - Admin+ SQL Injection

Published: February 7, 2022

Affected versions: *-5.8.17
Patched versions: 5.8.22

Original Wordfence record

HighCVE-2021-24138

AdRotate < 5.8.4 - Authenticated SQL Injection

Published: June 3, 2020

Affected versions: [*, 5.8.4)
Patched versions: 5.8.4

Original Wordfence record

HighCVE-2019-13570

AdRotate – Ad manager & AdSense Ads <= 5.2 - Authenticated SQL Injection

Published: July 11, 2019

Affected versions: *-5.2
Patched versions: 5.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2014-1854

AdRotate – Ad manager & AdSense Ads 3.9 - 3.9.4 - SQL Injection

Published: February 22, 2014

Affected versions: 3.9-3.9.4
Patched versions: 3.9.5

Original Wordfence record

CriticalCVE-2011-4671

AdRotate – Ad manager & AdSense Ads < 3.6.8 - SQL Injection

Published: November 8, 2011

Affected versions: [*, 3.6.8)
Patched versions: 3.6.8

Original Wordfence record

HighCVE-2022-26366

AdRotate Banner Manager <= 5.9 - Cross-Site Request Forgery

Published: November 11, 2022

Affected versions: *-5.9
Patched versions: 5.9.1

Original Wordfence record

HighCVE-2026-12242

AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute

Published: June 23, 2026

Affected versions: *-5.17.7
Patched versions: 5.17.8

Original Wordfence record

HighCVE-2022-0267

AdRotate – Ad manager & AdSense Ads <= 5.8.17 - Admin+ SQL Injection

Published: February 7, 2022

Affected versions: *-5.8.17
Patched versions: 5.8.22

Original Wordfence record

HighCVE-2022-1206

AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload

Published: August 19, 2024

Affected versions: *-5.13.2
Patched versions: 5.13.3

Original Wordfence record

HighCVE-2019-13570

AdRotate – Ad manager & AdSense Ads <= 5.2 - Authenticated SQL Injection

Published: July 11, 2019

Affected versions: *-5.2
Patched versions: 5.3

Original Wordfence record

HighCVE-2021-24138

AdRotate < 5.8.4 - Authenticated SQL Injection

Published: June 3, 2020

Affected versions: [*, 5.8.4)
Patched versions: 5.8.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory