https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-6459.htmlhttps://patchthecve.com/cve/CVE-2025-6459.htmlWed, 17 Jun 2026 10:01:56 +0000HIGH 8.8: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenthttps://patchthecve.com/cve/CVE-2025-6437.htmlhttps://patchthecve.com/cve/CVE-2025-6437.htmlWed, 17 Jun 2026 10:01:53 +0000HIGH 7.5: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL qhttps://patchthecve.com/cve/CVE-2025-5339.htmlhttps://patchthecve.com/cve/CVE-2025-5339.htmlWed, 17 Jun 2026 09:47:42 +0000HIGH 7.5: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on https://patchthecve.com/cve/CVE-2025-4689.htmlhttps://patchthecve.com/cve/CVE-2025-4689.htmlWed, 17 Jun 2026 09:33:47 +0000CRITICAL 9.8: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerabihttps://patchthecve.com/cve/CVE-2025-4381.htmlhttps://patchthecve.com/cve/CVE-2025-4381.htmlWed, 17 Jun 2026 09:33:09 +0000HIGH 7.5: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparahttps://patchthecve.com/cve/CVE-2025-4380.htmlhttps://patchthecve.com/cve/CVE-2025-4380.htmlWed, 17 Jun 2026 09:33:09 +0000HIGH 8.1: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to inclhttps://patchthecve.com/cve/CVE-2024-13322.htmlhttps://patchthecve.com/cve/CVE-2024-13322.htmlWed, 17 Jun 2026 07:01:46 +0000HIGH 7.5: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL https://patchthecve.com/cve/CVE-2024-52428.htmlhttps://patchthecve.com/cve/CVE-2024-52428.htmlWed, 17 Jun 2026 08:07:12 +0000HIGH 8.1: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through <= 1.12.