CVE-2022-0267: Adrotate Project Adrotate

High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days.

The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection

Affected products

• Adrotate Project Adrotate: before 5.8.22 (fixed in 5.8.22)

Published 2022-03-07. Last modified 2026-06-17.