653 matches found
CVE-2022-23912
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-23911
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
CVE-2022-23912
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
Sql injection
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
Cross site scripting
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-23912 AP Custom Testimonial < 1.4.8 - Reflected Cross-Site Scripting
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-23912
The CVE-2022-23912 entry concerns the WordPress AP Custom Testimonial plugin (and related Testimonial plugin lineage) with a Reflected XSS vulnerability caused by not sanitising/escaping the id parameter before outputting it in an attribute. Affected versions are ≤ 1.4.7; exploitation could injec...
CVE-2022-23911 AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
CVE-2022-23911
The CVE-2022-23911 entry concerns the WordPress AP Custom Testimonial Plugin (pre-1.4.7). The vulnerability is a SQL Injection caused by not validating/escaping the id parameter when retrieving a testimonial to edit, enabling an attacker to manipulate SQL statements. Several connected sources cor...
WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin versions = 1.3. Solution Update the WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin to the latest available version...
WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin <= 1.3 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin versions = 1.3. Solution Update the WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin to the latest available version at least 1.4...
CVE-2022-23912: Improper Neutralization of Input During Web Page Generation
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-23911: Improper Neutralization of Special Elements used in an SQL Command
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
PT-2022-16329
Name of the Vulnerable Software and Affected Versions Testimonial WordPress Plugin versions prior to 1.4.7 Description The issue arises from the lack of validation and escaping of the id parameter before its use in a SQL statement, leading to SQL Injection when retrieving a testimonial to edit...
WordPress plugin Testimonial 跨站脚本漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress Testimonial Plugin prior to 1.4.7. The vulnerability stems from the failure of the Testimonial plugin to clean and escape...
WordPress SQL注入漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. A SQL injection vulnerability exists in versions of the WordPress Testimonial Plugin prior to 1.4.7. The vulnerability stems from the failure of the Testimonial plugin to validate and escape befo...
PT-2022-16330
Name of the Vulnerable Software and Affected Versions Testimonial WordPress Plugin versions prior to 1.4.7 Description The issue is related to a Reflected cross-Site Scripting problem. It occurs because the id parameter is not properly sanitised and escaped before being outputted back in an...
AP Custom Testimonial < 1.4.8 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting https://example.com/wp-admin/admin.php?page=apcttestimonialedit&id=1"alert/XSS/...
WordPress AP Custom Testimonial plugin <= 1.4.7 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Rafael Castilho in WordPress AP Custom Testimonial plugin versions = 1.4.7. Solution Update the WordPress AP Custom Testimonial plugin to the latest available version at least 1.4.8...
WordPress AP Custom Testimonial plugin <= 1.4.7 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by Rafael Castilho in WordPress AP Custom Testimonial plugin versions = 1.4.7. Solution Update the WordPress AP Custom Testimonial plugin to the latest available version at least 1.4.8...