CVE-2016-10736

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-107375.4Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.CVE-2016-107388.8Zenbership v107 has CSRF via admin/cp-functions/event-add.php.CVE-2016-107395.3In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 adCVE-2016-10749.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC ContinCVE-2016-107404.9Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of confiCVE-2016-107414.7In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race cCVE-2016-107426.1Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect viCVE-2016-107437.5hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.CVE-2016-107446.1In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data lCVE-2016-107458.6In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.CVE-2016-107467.5libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connecCVE-2016-107499.8parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and en
CVE-2016-10736: Medium severity, CVSS 6.1 | Vulnix