Plugin security history

GD Rating System Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 14 vulnerability records associated with GD Rating System, published between 2017 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

14Total records

0Critical

6High

8Medium

0Low

0Informational

14Patched records

0Currently marked unpatched

2017-02-23First disclosure

2026-07-02Latest disclosure

14 of 14CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2017	1	1 records
2018	8	8 records
2024	3	3 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	6	42.9%
Medium	8	57.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

7 records50%

First: 2017. Latest: 2024.

Path Traversal

4 records28.6%

First: 2018. Latest: 2018.

SQL Injection

2 records14.3%

First: 2026. Latest: 2026.

Other

1 record7.1%

First: 2024. Latest: 2024.

Patch Status

Patched: 14
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.7.1
3.7
3.6.2
3.6.1
3.5.1
2.3.1
2.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.7`	GD Rating System <= 3.7 - Authenticated (Contributor+) SQL Injection	July 2, 2026	3.7.1	Medium
`*-3.6.2`	GD Rating System <= 3.6.2 - Unauthenticated SQL Injection	April 29, 2026	3.7	High
`*-3.6.1`	GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter	November 19, 2024	3.6.2	Medium
`*-3.6`	GD Rating System <= 3.6 - Authenticated (Contributor+) Local File Inclusion	July 11, 2024	3.6.1	High
`*-3.5.0`	GD Rating System <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting via IP	January 8, 2024	3.5.1	Medium
`[*, 2.3.1)`	GD Rating System <= 2.3 - Directory Traversal	January 8, 2018	2.3.1	High
`[*, 2.3.1)`	GD Rating System <= 2.3 - Cross-Site Scripting	January 8, 2018	2.3.1	Medium
`[*, 2.3.1)`	GD Rating System <= 2.3 - Cross-Site Scripting	January 8, 2018	2.3.1	Medium
`[*, 2.3.1)`	GD Rating System <= 2.3 - Cross-Site Scripting	January 8, 2018	2.3.1	Medium
`[*, 2.3.1)`	GD Rating System <= 2.3 - Cross-Site Scripting	January 8, 2018	2.3.1	Medium
`[*, 2.3.1)`	GD Rating System <= 2.3 - Directory Traversal	January 8, 2018	2.3.1	High
`[*, 2.3.1)`	GD Rating System <= 2.3 - Directory Traversal	January 8, 2018	2.3.1	High
`[*, 2.3.1)`	GD Rating System <= 2.3 - Directory Traversal	January 8, 2018	2.3.1	High
`[*, 2.1)`	GD Rating System < 2.1 - Reflected Cross-Site Scripting	February 23, 2017	2.1	Medium

Selected source records

Latest Records

MediumCVE-2026-57771

GD Rating System <= 3.7 - Authenticated (Contributor+) SQL Injection

Published: July 2, 2026

Affected versions: *-3.7
Patched versions: 3.7.1

Original Wordfence record

HighCVE-2026-42639

GD Rating System <= 3.6.2 - Unauthenticated SQL Injection

Published: April 29, 2026

Affected versions: *-3.6.2
Patched versions: 3.7

Original Wordfence record

MediumCVE-2024-11198

GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter

Published: November 19, 2024

Affected versions: *-3.6.1
Patched versions: 3.6.2

Original Wordfence record

HighCVE-2024-38709

GD Rating System <= 3.6 - Authenticated (Contributor+) Local File Inclusion

Published: July 11, 2024

Affected versions: *-3.6
Patched versions: 3.6.1

Original Wordfence record

MediumCVE-2024-25093

GD Rating System <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting via IP

Published: January 8, 2024

Affected versions: *-3.5.0
Patched versions: 3.5.1

Original Wordfence record

HighCVE-2018-5287

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

HighCVE-2018-5291

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

HighCVE-2018-5290

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

Highest-Severity Records

HighCVE-2024-38709

GD Rating System <= 3.6 - Authenticated (Contributor+) Local File Inclusion

Published: July 11, 2024

Affected versions: *-3.6
Patched versions: 3.6.1

Original Wordfence record

HighCVE-2018-5287

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

HighCVE-2018-5291

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

HighCVE-2018-5290

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

HighCVE-2026-42639

GD Rating System <= 3.6.2 - Unauthenticated SQL Injection

Published: April 29, 2026

Affected versions: *-3.6.2
Patched versions: 3.7

Original Wordfence record

HighCVE-2018-5289

GD Rating System <= 2.3 - Directory Traversal

Published: January 8, 2018

Affected versions: [*, 2.3.1)
Patched versions: 2.3.1

Original Wordfence record

MediumCVE-2024-25093

GD Rating System <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting via IP

Published: January 8, 2024

Affected versions: *-3.5.0
Patched versions: 3.5.1

Original Wordfence record

MediumCVE-2026-57771

GD Rating System <= 3.7 - Authenticated (Contributor+) SQL Injection

Published: July 2, 2026

Affected versions: *-3.7
Patched versions: 3.7.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory