CVE-2016-10902

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-109038.8The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-109049.8The olimometer plugin before 2.57 for WordPress has SQL injection.CVE-2016-109057.8An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and rCVE-2016-109067.0An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race conditiCVE-2016-109077.8An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755CVE-2016-109086.1The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-109099.8The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10919.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and AcroCVE-2016-109106.1The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.CVE-2016-109116.1The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.CVE-2016-109126.1The universal-analytics plugin before 1.3.1 for WordPress has XSS.CVE-2016-109136.1The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
CVE-2016-10902: High severity, CVSS 8.8 | Vulnix