CVE-2021-24492: Improper Neutralization of Special Elements used in an SQL Command

The hndtstactioninstancecallback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtstpreviewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL...

WordPress Handsome Testimonials & Reviews <= 2.1.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar Codevigilant Project in WordPress Handsome Testimonials & Reviews versions = 2.1.0. Solution Update the WordPress Handsome Testimonials & Reviews to the latest available version at least 2.1.1...

Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL Injection

The hndtstactioninstancecallback AJAX call of the plugin, available to any authenticated users, does not sanitise, validate or escape the hndtstpreviewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue. curl -i -s -k -X $'POST' \ -H...

Akamai Recognized as 2021 Gartner Peer Insights Customers' Choice for Web Application Firewalls

Akamai has been named a Gartner Peer Insights Customers' Choice for Web Application Firewalls for the second time. Gartner defines web application firewalls WAFs as "solutions designed to protect web applications and APIs from a variety of attacks, including automated bots, injection and...

Premium Addons for Elementor < 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS)

The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Testimonials” widget accepts a “premiumtestimonialpersonnamesize” parameter...

WordPress Easy Testimonials Plugin < 3.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113813";...

Wordpress Testimonials Widget Cross-Site Scripting Vulnerability

Wordpress Testimonials Widget is Wordpress open source an application plugin . Provide testimonials function. A cross-site scripting vulnerability exists in Testimonials Widget WordPress plugin versions prior to 4.0.0. The vulnerability stems from the program not properly validating input and not...

CVE-2021-24136

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

Cross site scripting

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136 Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136

The CVE-2021-24136 entry concerns the WordPress plugin Testimonials Widget. Multiple connected sources confirm that versions before 4.0.0 suffer from unvalidated input and lack of output encoding, enabling Cross-Site Scripting (XSS) via fields in Testimonial Data: Author, Job Title, Location, Com...

Wordpress Testimonials Widget 跨站脚本漏洞

Wordpress Testimonials Widget is Wordpress open source an application plugin . Provide testimonials function. A cross-site scripting vulnerability exists in Testimonials Widget WordPress plugin versions prior to 4.0.0. The vulnerability stems from the program not properly validating input and not...

CVE-2021-24136: Improper Neutralization of Input During Web Page Generation

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

WordPress Easy Testimonials plugin <= 3.6.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Easy Testimonials plugin versions = 3.6.1. Solution Update the WordPress Easy Testimonials plugin to the latest available version at least 3.7...

WordPress Testimonials Widget plugin <= 2.5.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities found by Nguyen Anh Tien in WordPress Testimonials Widget plugin versions = 2.5.1. Solution Update the WordPress Testimonials Widget plugin to the latest available version at least 4.0.0...

Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Multiple cross-site scripting vulnerabilities in Testimonials Widget 3.5.1 and lower allow remote attackers to inject arbitrary Javascript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL Successful exploitation of this vulnerability would allow...

Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Multiple cross-site scripting vulnerabilities in Testimonials Widget 3.5.1 and lower allow remote attackers to inject arbitrary Javascript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL Successful exploitation of this vulnerability would allow...

CVE-2020-14959

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter...