CVE-2018-1002000

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Kiboko Labs https://calendarscripts.info/	Arigato Autoresponder and Newsletter	>= unspecified, <= 2.5.1.8

References

http://www.vapidlabs.com/advisory.php?v=203Exploit, Third Party Advisory
https://wordpress.org/plugins/bft-autoresponder/Product
https://www.exploit-db.com/exploits/45434/Exploit, Third Party Advisory, VDB Entry
http://www.vapidlabs.com/advisory.php?v=203Exploit, Third Party Advisory
https://wordpress.org/plugins/bft-autoresponder/Product
https://www.exploit-db.com/exploits/45434/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Dec 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10020014.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020024.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020034.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020044.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020054.8These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_si CVE-2018-10020064.8These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: v CVE-2018-10020074.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020084.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020094.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-100215.5drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by trigger CVE-2018-10021005.5In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned f CVE-2018-10021019.8In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi