CVE-2016-20066 - CVE House

Back to Database

Status published Medium CVE-2016-20066

WordPress CP Polls 1.0.8 Persistent Cross-Site Scripting

5.1 CVSS

Vulnerability Description

WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-20066

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]

References

More from dwbooster

View All →

The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS...

The corner-ad plugin before 1.0.8 for WordPress has XSS....

WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS

WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

Affected Vendor

dwbooster

View all reports →

Affected Software

CP Polls

Vulnerable Versions:

1.0.8

Timeline

Official Publish: June 15th, 2026

Last Modified: June 15th, 2026

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement