The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] parameter in a sam_hits action to sam-ajax.php; the (2) cstr parameter in a load_posts action to sam-ajax-admin.php; the (3) searchTerm parameter in a load_combo_data action to sam-ajax-admin.php; or the (4) subscriber, (5) contributor, (6) author, (7) editor, (8) admin, or (9) sadmin parameter in a load_users action to sam-ajax-admin.php.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Simple Ads Manager Plugin | — | Update simple-ads-manager plugin to version 2.7.97, or a newer patched version | May 15, 2025 | Apr 2, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub