CVE-2017-18580

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-185816.1The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-185826.1The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.CVE-2017-185839.8The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.CVE-2017-185847.5The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-185858.1The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.CVE-2017-185869.1The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.CVE-2017-185875.3An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.CVE-2017-185885.3An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if CliCVE-2017-185897.5An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.CVE-2017-185906.1The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.CVE-2017-185916.1The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.CVE-2017-185927.5The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
CVE-2017-18580: Critical severity, CVSS 9.8 | Vulnix