CVE-2017-18605

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-186066.1The avada theme before 5.1.5 for WordPress has stored XSS.CVE-2017-186078.8The avada theme before 5.1.5 for WordPress has CSRF.CVE-2017-186086.1The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.CVE-2017-186096.1The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.CVE-2017-186106.1The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.CVE-2017-186116.1The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.CVE-2017-186126.1The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.CVE-2017-186136.1The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.CVE-2017-186148.1The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.CVE-2017-186156.1The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.CVE-2017-186349.8The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.CVE-2017-186356.1An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page
CVE-2017-18605: Critical severity, CVSS 9.8 | Vulnix