CVE-2018-17884

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.defensecode.com/advisories/DC-2018-05-008_WordPress_Gwolle_Guestbook_Plugin_Advisory.pdfExploit, Third Party Advisory
https://seclists.org/bugtraq/2018/Jul/74Exploit, Mailing List, Third Party Advisory
https://wordpress.org/plugins/gwolle-gb/#developersThird Party Advisory
http://www.defensecode.com/advisories/DC-2018-05-008_WordPress_Gwolle_Guestbook_Plugin_Advisory.pdfExploit, Third Party Advisory
https://seclists.org/bugtraq/2018/Jul/74Exploit, Mailing List, Third Party Advisory
https://wordpress.org/plugins/gwolle-gb/#developersThird Party Advisory

Timeline

Published: Oct 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-178865.4An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, a CVE-2018-178889.8NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active CVE-2018-178895.3In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the CVE-2018-17899.9IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request for CVE-2018-178909.8NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arb CVE-2018-178913.7Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream se CVE-2018-178928.8NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security featu CVE-2018-178939.8LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution.CVE-2018-178949.8NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker CVE-2018-178959.8LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.CVE-2018-178968.1Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded crede CVE-2018-178979.8LAquis SCADA Versions 4.1.0.3870 and prior has several integer overflow to buffer overflow vulnerabilities, which may allow remote code exec