CVE-2026-115603

HighCVSS 8.5

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The WordPress plugin Advanced Ads – Tracking before 4.0.0 contains an SQL injection vulnerability allowing blind SQL injection.

Risk Assessment

Unauthorized reading or modification of data in the WordPress database via blind SQL injection is possible.

Recommendation

Update the Advanced Ads – Tracking plugin to version 4.0.0 or later, which contains the SQL injection fix.

Other vulnerabilities in Advanced Ads – Tracking

CVE-2025-59554Critical
There is an unauthenticated SQL injection vulnerability in Advanced Ads – Tracking versions below 3.0.7.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS