CVE-2017-18570

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-185719.8The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-201CVE-2017-185726.1The gnucommerce plugin before 1.4.2 for WordPress has XSS.CVE-2017-185739.8The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-185746.1The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-185756.1The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-185766.1The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.CVE-2017-185776.1The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-185786.1The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.CVE-2017-185796.1The corner-ad plugin before 1.0.8 for WordPress has XSS.CVE-2017-185809.8The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.CVE-2017-185816.1The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-185826.1The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
CVE-2017-18570: Critical severity, CVSS 9.8 | Vulnix