CVE-2016-10992

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.

Source: CVE-2016-10992

CVE-2016-10990

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.

Source: CVE-2016-10990

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.

Source: CVE-2016-10991

CVE-2016-10988

The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.

Source: CVE-2016-10988

CVE-2016-10989

The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.

Source: CVE-2016-10989

CVE-2016-10984

The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.

Source: CVE-2016-10984

CVE-2016-10987

The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.

Source: CVE-2016-10987

CVE-2016-10977

The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.

Source: CVE-2016-10977

CVE-2016-10978

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.

Source: CVE-2016-10978

CVE-2016-10979

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.

Source: CVE-2016-10979