WordPress plugin

System Dashboard security & vulnerabilities

Q: Is any System Dashboard vulnerability listed in CISA KEV?

No. None of the known System Dashboard vulnerabilities is currently listed in the CISA KEV catalog.

system-dashboard— active installsLast vulnerability Sep 25, 2025

No known unpatched vulnerabilities in the latest version

All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

11Known vulnerabilities

Critical0
High1
Medium10
Low0

Vulnerabilities per year

All System Dashboard vulnerabilities

System Dashboard vulnerabilities
Severity	Vulnerability	CVE	Published
Medium4.3	Cross-Site Request Forgery ≤2.8.20Update to 2.8.21	CVE-2025-10377	Sep 25, 2025
Medium4.3	Authenticated (Subscriber+) Sensitive Information Exposure ≤2.8.18Update to 2.8.19	CVE-2025-26911	Feb 23, 2025
Medium6.1	Reflected Cross-Site Scripting via Filename Parameter ≤2.8.17Update to 2.8.18	CVE-2024-12299	Jan 30, 2025
Medium4.9	Authenticated (Admin+) Arbitrary File Read ≤2.8.14Update to 2.8.15	CVE-2024-10708	Nov 19, 2024
High7.2	Unauthenticated Stored Cross-Site Scripting ≤2.8.14Update to 2.8.15	CVE-2024-11107	Nov 19, 2024
Medium6.1	Reflected Cross-Site Scripting via X-Forwarded-For ≤2.8.9Update to 2.8.10	CVE-2023-7246	Feb 28, 2024
Medium4.3	Missing Authorization to Information Disclosure (sd_constants) ≤2.8.7Update to 2.8.8	CVE-2023-5710	Dec 6, 2023
Medium4.3	Missing Authorization to Information Disclosure (sd_php_info) ≤2.8.7Update to 2.8.8	CVE-2023-5711	Dec 6, 2023
Medium4.3	Missing Authorization to Information Disclosure (sd_db_specs) ≤2.8.7Update to 2.8.8	CVE-2023-5714	Dec 6, 2023
Medium4.3	Missing Authorization to Information Disclosure (sd_global_value) ≤2.8.7Update to 2.8.8	CVE-2023-5712	Dec 6, 2023
Medium4.3	Missing Authorization to Information Disclosure (sd_option_value) ≤2.8.7Update to 2.8.8	CVE-2023-5713	Dec 6, 2023

Medium4.3
Cross-Site Request Forgery
≤2.8.20Update to 2.8.21
CVE-2025-10377Sep 25, 2025
Medium4.3
Authenticated (Subscriber+) Sensitive Information Exposure
≤2.8.18Update to 2.8.19
CVE-2025-26911Feb 23, 2025
Medium6.1
Reflected Cross-Site Scripting via Filename Parameter
≤2.8.17Update to 2.8.18
CVE-2024-12299Jan 30, 2025
Medium4.9
Authenticated (Admin+) Arbitrary File Read
≤2.8.14Update to 2.8.15
CVE-2024-10708Nov 19, 2024
High7.2
Unauthenticated Stored Cross-Site Scripting
≤2.8.14Update to 2.8.15
CVE-2024-11107Nov 19, 2024
Medium6.1
Reflected Cross-Site Scripting via X-Forwarded-For
≤2.8.9Update to 2.8.10
CVE-2023-7246Feb 28, 2024
Medium4.3
Missing Authorization to Information Disclosure (sd_constants)
≤2.8.7Update to 2.8.8
CVE-2023-5710Dec 6, 2023
Medium4.3
Missing Authorization to Information Disclosure (sd_php_info)
≤2.8.7Update to 2.8.8
CVE-2023-5711Dec 6, 2023
Medium4.3
Missing Authorization to Information Disclosure (sd_db_specs)
≤2.8.7Update to 2.8.8
CVE-2023-5714Dec 6, 2023
Medium4.3
Missing Authorization to Information Disclosure (sd_global_value)
≤2.8.7Update to 2.8.8
CVE-2023-5712Dec 6, 2023
Medium4.3
Missing Authorization to Information Disclosure (sd_option_value)
≤2.8.7Update to 2.8.8
CVE-2023-5713Dec 6, 2023

System Dashboard: common questions

Does System Dashboard have known vulnerabilities?

Yes. VulnCrest Radar lists 11 known vulnerabilities in System Dashboard: 1 high, 10 medium. None are known to affect version null.

How do I check which version of System Dashboard I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent System Dashboard vulnerability?

CVE-2025-10377, published Sep 25, 2025: System Dashboard <= 2.8.20 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).

Is any System Dashboard vulnerability listed in CISA KEV?

No. None of the known System Dashboard vulnerabilities is currently listed in the CISA KEV catalog.