Ads Pro Plugin Multi Purpose Wordpress Advertising Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:scripteo:ads_pro_plugin_-_multi-purpose_wordpress_advertising_manager:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Scripteo (fb62dc56-587b-5d01-a950-a36500370dd7) |
|---|---|
| Product | Ads Pro Plugin Multi Purpose Wordpress Advertising Manager (fdc36c32-46c8-5cca-a09b-1059071de533) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-7402 |
vulnerable | 2026-06-08 07:43:18.468923 |
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.95 - Unauthenticated SQL Injection via site_id
HIGH (7.5)
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-11-24T04:36:40.730Z
Updated: 2026-04-08T16:53:27.824Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6459 |
vulnerable | 2026-06-08 07:43:15.095829 |
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate
HIGH (8.8)
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-07-02T03:47:22.333Z
Updated: 2026-04-08T16:41:50.309Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6437 |
vulnerable | 2026-06-08 07:43:15.058418 |
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oid
HIGH (7.5)
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-07-02T03:47:25.020Z
Updated: 2026-04-08T16:55:49.916Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5339 |
vulnerable | 2026-06-08 07:35:24.685367 |
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'
HIGH (7.5)
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-07-02T03:47:26.086Z
Updated: 2026-04-08T17:21:01.419Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4689 |
vulnerable | 2026-06-08 07:29:17.109168 |
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution
CRITICAL (9.8)
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
Published: 2025-07-02T03:47:21.403Z
Updated: 2026-04-08T16:32:56.793Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4381 |
vulnerable | 2026-06-08 07:29:16.182525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4380 |
vulnerable | 2026-06-08 07:29:16.181201 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13322 |
vulnerable | 2026-06-08 06:25:37.275783 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.