CVE-2014-1854: Adrotateplugin Adrotate

High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days.

SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.

Affected products

• Adrotateplugin Adrotate: version 3.9. only; version 3.9.1 only; version 3.9.2 only; version 3.9.3 only; version 3.9.4 only; version 3.9.5 only

Published 2014-02-27. Last modified 2026-06-17.