CVE-2022-23912

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...

Cross site scripting

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...

PT-2022-16329

Name of the Vulnerable Software and Affected Versions Testimonial WordPress Plugin versions prior to 1.4.7 Description The issue arises from the lack of validation and escaping of the id parameter before its use in a SQL statement, leading to SQL Injection when retrieving a testimonial to edit...

CVE-2022-23912: Improper Neutralization of Input During Web Page Generation

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...

CVE-2022-23911: Improper Neutralization of Special Elements used in an SQL Command

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...

PT-2022-16330

Name of the Vulnerable Software and Affected Versions Testimonial WordPress Plugin versions prior to 1.4.7 Description The issue is related to a Reflected cross-Site Scripting problem. It occurs because the id parameter is not properly sanitised and escaped before being outputted back in an...

PT-2021-16113

Name of the Vulnerable Software and Affected Versions Testimonial WordPress plugin versions prior to 1.6.0 Description The issue allows high privilege users to perform Cross Site Scripting attacks due to unescaped testimonial fields, even when the unfiltered html capability is disallowed...