CVE-2018-3810

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

• CWE-287

• https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.htmlExploit, Third Party Advisory
• https://wordpress.org/plugins/smart-google-code-inserter/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8987Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43420/Exploit, Third Party Advisory, VDB Entry
• https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.htmlExploit, Third Party Advisory
• https://wordpress.org/plugins/smart-google-code-inserter/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8987Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43420/Exploit, Third Party Advisory, VDB Entry

Published

Jan 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3783A privilege escalation detected in flintcms versions <= 1.1.…
• CVE-2018-3784A code injection in cryo 0.0.6 allows an attacker to arbitra…9.8
• CVE-2018-3785A command injection in git-dummy-commit v1.3.0 allows os lev…9.8
• CVE-2018-3786A command injection vulnerability in egg-scripts <v2.8.1 all…9.8
• CVE-2018-3787Path traversal in simplehttpserver <v0.2.1 allows listing an…7.5
• CVE-2018-3809Information exposure through directory listings in serve 6.5…
• CVE-2018-3811SQL Injection vulnerability in the Oturia Smart Google Code …
• CVE-2018-3813getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0…
• CVE-2018-3814Craft CMS 2.6.3000 allows remote attackers to execute arbitr…
• CVE-2018-3815The "XML Interface to Messaging, Scheduling, and Signaling" …
• CVE-2018-3817When logging warnings regarding deprecated settings, Logstas…
• CVE-2018-3818Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site sc…