CVE-2017-18571

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-185726.1The gnucommerce plugin before 1.4.2 for WordPress has XSS.CVE-2017-185739.8The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-185746.1The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-185756.1The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-185766.1The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.CVE-2017-185776.1The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-185786.1The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.CVE-2017-185796.1The corner-ad plugin before 1.0.8 for WordPress has XSS.CVE-2017-185809.8The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.CVE-2017-185816.1The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-185826.1The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.CVE-2017-185839.8The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
CVE-2017-18571: Critical severity, CVSS 9.8 | Vulnix