CVE-2016-10888

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-108899.8The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10899.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and AcroCVE-2016-108906.1The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.CVE-2016-108916.1The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.CVE-2016-108926.1The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.CVE-2016-108936.1The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-108944.6xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) varCVE-2016-108956.1The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2016-108966.1The seo-redirection plugin before 4.3 for WordPress has stored XSS.CVE-2016-108976.1The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-108986.1The total-security plugin before 3.4.1 for WordPress has XSS.CVE-2016-108995.3The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
CVE-2016-10888: Critical severity, CVSS 9.8 | Vulnix