CVE-2016-10976

The CVE concerns the WordPress Safe Editor plugin prior to version 1.2, where the se_save endpoint lacks authentication, enabling CSS/JS injection and resulting XSS. Affected component: safe-editor plugin for WordPress; root cause: missing authentication on se_save in admin-ajax flow; impact: una...