CVE-2023-2178

The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-45817

Cross-Site Scripting XSS vulnerability in Erin Garscadden GC Testimonials plugin = 1.3.2 versions...

CVE-2022-4717

The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2020-36749

The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to save custom fields via a...

CVE-2024-13704

The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stusertitle' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-13704

The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stusertitle' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-6314

The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'processimageupload' function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-51872 WordPress Luzuk Testimonials plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Luzuk Luzuk Testimonials allows Stored XSS.This issue affects Luzuk Testimonials: from n/a through 0.0.1...

CVE-2024-51936 WordPress ESB Testimonials plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Henry ESB Testimonials allows Stored XSS.This issue affects ESB Testimonials: from n/a through 1.0.0...

WordPress Awesome Fitness Testimonials Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Awesome Fitness Testimonials Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51806 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6dc5acf46761 Credits SOPROBRO Required privilege...

WordPress Aajoda Testimonials Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Aajoda Testimonials Type Plugin Vulnerable versions = 2.2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51614 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 68d3e8f6dba1 Credits SOPROBRO Required privilege...

WordPress Testimonials Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Testimonials Type Plugin Vulnerable versions = 4.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43959 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8da344adddf2 Credits Abdi Pranata Required privilege...

WordPress Easy Testimonials Plugin <= 3.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Testimonials Type Plugin Vulnerable versions = 3.9.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2337 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b71aceb02810 Credits Krzysztof Zając Required...

CVE-2024-2337

The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonialsgrid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2337

CVE-2024-2337 affects the WordPress plugin Easy Testimonials (versions up to and including 3.9.5). The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the plugin’s testimonials_grid shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. E...

WordPress IQ Testimonials plugin <= 2.2.7 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin IQ Testimonials versions = 2.2.7...

PT-2024-37535 · WordPress · Testimonials

Name of the Vulnerable Software and Affected Versions: IQ Testimonials plugin for WordPress versions up to, and including, 2.2.7 Description: The issue is related to insufficient file type validation in the process image upload function, allowing unauthenticated attackers to upload arbitrary file...

CVE-2023-6491

The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtstsaveviewsticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and...

WordPress plugin Strong Testimonials security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-4705

The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...