Known vulnerabilities in AdRotate Banner Manager

Easily manage, and schedule ads on your WordPress site with AdRotate. Support for Google AdSense, Amazon, and custom banners. Start monetizing today!

10Reported vulnerabilities

9.8Highest CVSS score

5.19.1Latest version

20,000+Active installs

What to do now

Update AdRotate Banner Manager to 5.17.8 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 25, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2014-1854	High 7.5	5.6%	3.9. to 3.9. (inclusive) 3.9.1 to 3.9.1 (inclusive) 3.9.2 to 3.9.2 (inclusive) 3.9.3 to 3.9.3 (inclusive) 3.9.4 to 3.9.4 (inclusive) 3.9.5 to 3.9.5 (inclusive)	`3.9.5`	February 27, 2014
CVE-2022-0267	High 7.2	1.3%	Before 5.8.22	`5.8.22`	March 7, 2022
CVE-2011-4671	Critical 9.8	2.9%	Before 3.6.8	`3.6.8`	November 8, 2011
CVE-2021-24138	Medium 5.5	1.2%	Before 5.8.4	`5.8.4`	March 18, 2021
CVE-2026-12242	High 8.8	0.9%	0 to 5.17.7 (inclusive)	`5.17.8`	June 24, 2026
CVE-2022-26366	High 8.8	0.3%	5.9 and earlier	`5.9.1`	November 30, 2022
CVE-2022-0662	Medium 4.8	0.6%	Before 5.8.23	`5.8.23`	May 2, 2022
CVE-2022-0649	Medium 4.8	0.6%	Before 5.8.23	`5.8.23`	May 2, 2022
CVE-2019-13570	High 7.2	1.5%	5.2 and earlier	`5.3`	July 11, 2019
CVE-2022-1206	High 7.2	1.0%	0 to 5.13.2 (inclusive) 0 to 5.13.2 (inclusive)	`5.13.3`	August 20, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.