WordPress Easy Testimonials 1.36.1 Cross Site Scripting

`------------------------------------------------------------------------  
Stored Cross-Site Scripting vulnerability in Easy Testimonials WordPress  
Plugin  
------------------------------------------------------------------------  
Bente Schopman, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
Multiple stored Cross-Site Scripting vulnerabilities were found in the  
Easy Testimonials WordPress Plugin. These issues can be exploited by an  
authenticated Contributor (or higher). It allows an attacker to perform  
a wide variety of actions, such as stealing users' session tokens, or  
performing arbitrary actions on their behalf.  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160712-0010  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
These issues were successfully tested on Easy Testimonials WordPress  
Plugin version 1.36.1.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
This issue is resolved in Easy Testimonials WordPress Plugin version  
1.37.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_easy_testimonials_wordpress_plugin.html  
  
This can be exploited by users with a role lower than the Editor (which has the unfiltered_html privileges) to add scripts and HTML when creating or updating a testimonial. This is possible by the following fields:  
  
- Client Name.  
- Position/Web Address/Other.  
- Location Reviewed/Product Reviewed/Item Reviewed.  
  
The vulnerability allows an attacker to perform a wide variety of actions, such as stealing users' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a victim into opening a malicious website.  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
`