CVE-2013-4241: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 image, 3 url, or 4 testimonial parameter to the Testimonial form hms-testimonials-addnew page; 5 dateformat...

PT-2014-2766

Name of the Vulnerable Software and Affected Versions HMS Testimonials plugin versions prior to 2.0.11 Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding new testimonials via the "hms-testimonials-addnew" page, addin...

CVE-2013-4240: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add new testimonials via the hms-testimonials-addnew page, 2 add new groups via the...