CVE-2016-10xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
969 records · Page 1 of 10
- CVE-2016-10999: The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. Unscored
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
Updated The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
UpdatedThe beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
UpdatedThe optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
UpdatedThe Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
UpdatedThe Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
Updated- CVE-2016-10993: The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. Unscored
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
Updated The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
Updated- CVE-2016-10991: The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. Unscored
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
Updated The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
UpdatedThe leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
UpdatedThe leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
UpdatedThe persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
UpdatedThe tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
UpdatedThe echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
Updated- CVE-2016-10984: The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. Unscored
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
Updated The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
UpdatedThe kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
UpdatedThe kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
UpdatedThe kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
UpdatedThe fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
UpdatedThe fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
UpdatedThe nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
UpdatedThe safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
UpdatedThe fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
UpdatedThe fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
UpdatedThe Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
UpdatedThe newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
UpdatedThe MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Updated- CVE-2016-10970: The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt. Unscored
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
Updated The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
UpdatedThe peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
UpdatedThe real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
UpdatedThe real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
UpdatedThe real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
Updated- CVE-2016-10964: The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. Unscored
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
Updated The icegram plugin before 1.9.19 for WordPress has XSS.
UpdatedThe icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
Updated- CVE-2016-10961: The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. Unscored
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
Updated The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
UpdatedThe estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
UpdatedThe estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
UpdatedThe Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
UpdatedThe mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.
UpdatedThe cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
Updated- CVE-2016-10954: The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. Unscored
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
Updated - CVE-2016-10953: The Headway theme before 3.8.9 for WordPress has XSS via the license key field. Unscored
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
Updated The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
UpdatedThe fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
Updated- CVE-2016-10950: The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. Unscored
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
Updated The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
UpdatedThe Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
UpdatedThe Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
UpdatedThe wp-d3 plugin before 2.4.1 for WordPress has CSRF.
UpdatedThe PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
UpdatedThe multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Updated- CVE-2016-10943: The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. Unscored
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
Updated The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
UpdatedThe podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Updated- CVE-2016-10940: The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. Unscored
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Updated - CVE-2016-10939: The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. Unscored
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
Updated The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Updated- CVE-2016-10937: IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate. Unscored
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
Updated - CVE-2016-10936: The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. Unscored
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
Updated - CVE-2016-10935: The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation. Unscored
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
Updated The check-email plugin before 0.5.2 for WordPress has XSS.
UpdatedAn issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
UpdatedAn issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
UpdatedAn issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
UpdatedThe wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
UpdatedThe advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
UpdatedThe onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
UpdatedThe nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
UpdatedThe nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
UpdatedThe peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Updated- CVE-2016-10924: The ebook-download plugin before 1.2 for WordPress has directory traversal. Unscored
The ebook-download plugin before 1.2 for WordPress has directory traversal.
Updated The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
UpdatedThe woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
Updated- CVE-2016-10921: The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. Unscored
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
Updated The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
UpdatedThe wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
UpdatedThe gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
UpdatedThe search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
UpdatedThe appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
UpdatedThe popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
UpdatedThe add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
UpdatedThe wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
UpdatedThe universal-analytics plugin before 1.3.1 for WordPress has XSS.
Updated- CVE-2016-10911: The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. Unscored
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
Updated The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
UpdatedThe booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Updated- CVE-2016-10908: The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS. Unscored
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Updated An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
UpdatedAn issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.
UpdatedAn issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
UpdatedThe olimometer plugin before 2.57 for WordPress has SQL injection.
UpdatedThe GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
UpdatedThe wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
UpdatedThe wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
UpdatedThe uji-countdown plugin before 2.0.7 for WordPress has XSS.
Updated