title: AdRotate < 5.8.22 - Admin+ SQL Injection
description: The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
problem types: CWE-89 SQL Injection
affected:
{
product: AdRotate – Ad manager & AdSense Ads
vendor: Unknown
versions:
lessThan: 5.8.22, status: affected, version: 5.8.22, versionType: custom
}