CVE-2016-10969

CVE-2016-10969: The WordPress SupportFlow plugin is vulnerable to stored XSS via a discussion ticket title in versions before 0.7. The issue originates from the plugin’s handling of ticket titles, enabling script injection that could execute in a user’s browser. Affects the SupportFlow WordPress ...

CVE-2016-10970

CVE-2016-10970 affects the WordPress plugin SupportFlow ; it is a stored XSS vulnerability in the ticket excerpt. The issue is present in plugin versions before 0.7. No exploitation details are provided in the documents. Remediation, as implied, is to upgrade to 0.7 or later (the fix version is n...