PLUGIN SECURITY
Is Adrotate safe?
Easily manage, and schedule ads on your WordPress site with AdRotate. Support for Google AdSense, Amazon, and custom banners. Start monetizing today!
What this plugin does
- Slug:
adrotate - Author: Arnan
- 20000+ active installs
- 86/100 rating (655 reviews on wordpress.org)
- 3970664 all-time downloads
- On WordPress.org since 2008-07-01
ad manageradsadsensebannermonetize
Maintenance status
- Latest known version: 5.19.1
- Last updated: 2026-08-25 2:48am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 8.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
10 known CVEs on file for Adrotate. Reported between 2011 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-12242 | AdRotate Banner Manager [adrotate] < 5.17.8 | Improper Control of Generation of Code ('Code Injection') | High 8.8 | < 5.17.8 | 5.17.8 | 2026-06-23 | ✓ fixed in latest |
| CVE-2022-1206 | AdRotate Banner Manager [adrotate] < 5.13.3 | Unrestricted Upload of File with Dangerous Type | High 7.2 | < 5.13.3 | 5.13.3 | 2024-08-19 | ✓ fixed in latest |
| CVE-2022-26366 | AdRotate Banner Manager [adrotate] < 5.9.1 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 5.9.1 | 5.9.1 | 2022-11-11 | ✓ fixed in latest |
| CVE-2022-0649 | AdRotate Banner Manager [adrotate] < 5.8.23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.8.23 | 5.8.23 | 2022-04-11 | ✓ fixed in latest |
| CVE-2022-0662 | AdRotate Banner Manager [adrotate] < 5.8.23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.8.23 | 5.8.23 | 2022-04-11 | ✓ fixed in latest |
| CVE-2022-0267 | AdRotate Banner Manager [adrotate] < 5.8.23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 5.8.23 | 5.8.23 | 2022-02-07 | ✓ fixed in latest |
| CVE-2021-24138 | AdRotate Banner Manager [adrotate] < 5.8.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 5.5 | < 5.8.4 | 5.8.4 | 2020-06-03 | ✓ fixed in latest |
| — | AdRotate Banner Manager [adrotate] < 5.8.4 | — | Unknown | < 5.8.4 | 5.8.4 | 2020-06-03 | ✓ fixed in latest |
+ 3 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2019-13570 | AdRotate Banner Manager [adrotate] < 5.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 5.3 | 5.3 | 2019-07-11 | ✓ fixed in latest |
| CVE-2014-1854 | AdRotate Banner Manager [adrotate] >= 3.9 - <= 3.9.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | 3.9–3.9.5 | 3.9.5 | 2014-02-22 | ✓ fixed in latest |
| CVE-2011-4671 | AdRotate Banner Manager [adrotate] < 3.6.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 3.6.8 | 3.6.8 | 2011-09-24 | ✓ fixed in latest |
How to fix it
Keep Adrotate updated — 5.19.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Google for WooCommerce — 800000+ active installs — 54/100 (266)
- Ad Inserter – Ad Manager & AdSense Ads — 300000+ active installs — 98/100 (2428) — max PHP 8.4
- Head, Footer and Post Injections — 200000+ active installs — 98/100 (735) — max PHP 8.4
- Ads.txt Manager — 100000+ active installs — 94/100 (15) — max PHP 8.4
- Advanced Ads – Ad Manager & AdSense — 100000+ active installs — 98/100 (1461)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.