PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-0765 Elfden CVE debrief

CVE-2016-0765 is a medium-severity cross-site scripting issue in the eShop plugin 6.3.14 for WordPress. According to NVD, the vulnerable code is in eshop-orders.php and the attack can be triggered through the page or action parameter. Because this is an XSS flaw, successful exploitation can let an attacker inject script or HTML into a victim’s browser session, most importantly affecting users who can be lured into visiting a crafted link or page.

Vendor
Elfden
Product
CVE-2016-0765
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

WordPress site owners and administrators using the eShop plugin 6.3.14, especially teams that allow user interaction with the affected order pages. Security teams responsible for plugin inventory, web application hardening, and content sanitization should prioritize review as well.

Technical summary

NVD classifies this issue as CWE-79 (cross-site scripting) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which indicates network-based exploitation with no privileges required but with user interaction needed. The vulnerable CPE listed by NVD is elfden:eshop_plugin:6.3.14 on WordPress. The supplied sources do not identify a fixed version, so defensive guidance should focus on updating to a vendor-repaired release if available or removing the plugin if it is unmaintained.

Defensive priority

Medium

Recommended defensive actions

  • Inventory WordPress sites for eShop plugin 6.3.14 and identify any exposed instances of eshop-orders.php.
  • Upgrade to a vendor-fixed version if one is available; if no fix exists, disable or remove the plugin.
  • Review the plugin’s handling of the page and action parameters and ensure all output is properly escaped and input is validated.
  • Monitor for suspicious requests and browser-side injection indicators in access logs and application logs.
  • Apply general web application hardening controls that reduce XSS impact, such as output encoding and security testing during maintenance windows.

Evidence notes

The debrief is based on the supplied NVD record and its listed references. NVD identifies the weakness as CWE-79, the vulnerable component as eShop plugin 6.3.14 for WordPress, and the affected parameters as page and action in eshop-orders.php. The record also lists third-party advisory references from Openwall, SecurityFocus, and DHS/Vapid. No fixed version or vendor remediation details were included in the provided source corpus.

Official resources

The CVE record was published by NVD on 2017-01-23. The supplied reference links point to earlier February 2016 third-party advisories, but the CVE publication date used here is the official CVE/NVD publishedAt timestamp.