First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2016-10886

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Aug 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-108879.8The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.CVE-2016-108889.8The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.CVE-2016-108899.8The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10899.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acro CVE-2016-108906.1The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.CVE-2016-108916.1The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.CVE-2016-108926.1The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.CVE-2016-108936.1The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-108944.6xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) var CVE-2016-108956.1The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2016-108966.1The seo-redirection plugin before 4.3 for WordPress has stored XSS.CVE-2016-108976.1The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.

CVE-2016-10886: Critical severity, CVSS 9.8 | Vulnix