CVE-2016-10868

CVE-2016-10868 describes a Cross-Site Scripting (XSS) vulnerability found in the all-in-one-wp-security-and-firewall plugin for WordPress, specifically in versions prior to 4.0.5. This vulnerability allows attackers to inject malicious scripts into the blacklist, file system, and file change detection settings pages. Rated with a CVSS score of 6.1 (Medium), the vulnerability has a network attack vector and low attack complexity, requiring user interaction (UI:R) to exploit. A successful attack could lead to limited confidentiality and integrity impacts (C:L/I:L) for affected users. There is no evidence of active exploitation, nor are there known public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention.