CVE-2016-10976
published 2019-09-17CVE-2016-10976: The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
PriorityP338medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.51%
71.2th percentile
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kodebyraaet | safe_editor | < 1.2 | 1.2 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3p27-5462-4944: The safe-editor plugin before 1
ghsa_unreviewed·2022-05-24
CVE-2016-10976 [MEDIUM] CWE-79 GHSA-3p27-5462-4944: The safe-editor plugin before 1
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Red Hat
postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
vendor_redhat·2024-11-14·CVSS 7.5
CVE-2024-10976 [HIGH] CWE-1250 postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a commo
No detection rules found.
Nuclei
Safe Editor Plugin < 1.2 - CSS/JS-injection
nuclei·CVSS 6.1
CVE-2016-10976 [MEDIUM] Safe Editor Plugin < 1.2 - CSS/JS-injection
Safe Editor Plugin < 1.2 - CSS/JS-injection
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Template:
id: CVE-2016-10976
info:
name: Safe Editor Plugin < 1.2 - CSS/JS-injection
author: Splint3r7
severity: medium
description: |
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
impact: |
Unauthenticated attackers can inject malicious JavaScript or CSS code into the site, potentially stealing credentials, manipulating site content, or targeting site visitors.
remediation: |
Update to the latest version of safe-editor plugin or apply the patch provided by the vendor.
reference:
- https://wordpress.org/plugins/safe-editor/#developers
- https://github.com/ARPSyndicate/cvemon
- https://nvd.nist
2019-09-17
Published