CVE-2016-1000154

Vulnerability

Reflected Cross-Site Scripting (XSS) exists in WordPress plugin WHIZZ version 1.0.7. The plugin fails to properly sanitize user input before including it in page output, allowing an attacker to inject arbitrary JavaScript or HTML via a crafted URL. The vulnerability affects the whizz plugin version 1.0.7, which was hosted on the WordPress.org plugin directory until its closure [1][2].

Exploitation

An attacker can exploit this flaw by tricking a logged-in WordPress administrator into clicking a malicious link that contains the XSS payload. No authentication is required for the attacker, but the victim user must have the ability to manage WordPress settings to fully leverage the attack. The XSS payload executes in the context of the victim's browser session with the WordPress site, enabling the attacker to perform actions on behalf of the victim [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, leading to session hijacking, defacement, or theft of sensitive data (e.g., cookies, authentication tokens). The attacker could potentially gain administrative-level access to the WordPress instance if the victim has elevated privileges. The impact is limited to the scope of the affected WordPress site and the victim's session [1][2].

Mitigation

The WHIZZ plugin has been closed and removed from the WordPress.org plugin directory as of December 3, 2025 due to a Guideline Violation, and no patched version is available. Users who have this plugin installed should uninstall it immediately to prevent any potential exploitation. There is no official fix or workaround provided by the plugin author [1][2].