CVE-2015-2824: Simple Ads Manager Project Simple Ads Manager

High severity, CVSS 7.5. EPSS: 6.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] parameter in a sam_hits action to sam-ajax.php; the (2) cstr parameter in a load_posts action to sam-ajax-admin.php; the (3) searchTerm parameter in a load_combo_data action to sam-ajax-admin.php; or the (4) subscriber, (5) contributor, (6) author, (7) editor, (8) admin, or (9) sadmin parameter in a load_users action to sam-ajax-admin.php.

Affected products

• Simple Ads Manager Project Simple Ads Manager: version 2.5.94 only; version 2.5.96 only

Published 2015-04-06. Last modified 2026-06-17.