CVE-2026-115603

WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

Advanced Ads GmbH Advanced Ads – Tracking

Open in Threatline Record JSON

CVSS

8.5High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in4.0.0Fixed versionCVE List

Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

4.0.0Advanced Ads – TrackingCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.

Text from CVE List

Affected versions 1

Advanced Ads – Trackingaffected: all versions before 4.0.0CVE List

References 1

patchstack.com/database/wordpress/plugin/advanced-ads-tracking/vulnerability/wordpress-advanced-ads-tracking-plugin-4-0-0-sql-injection-vulnerability?_s_id=cveReferencevia CVE List