732 matches found
Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. id: CVE-2017-18558 info: name: Testimonials by BestWebSoft 0.1.9 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS...
Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...
CVE-2026-16786
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-16786
The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.19) is vulnerable to Stored Cross-Site Scripting via the dslc_module_testimonials_output Shortcode. The root cause is insufficient input sanitization and output escaping: the injected payload survives save-time wp_kses_post...
CVE-2026-16786 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...
CVE-2026-15245
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...
CVE-2026-15245
CVE-2026-15245 affects the BNE Testimonials WordPress plugin prior to 2.0.8.2. The vulnerability arises from insufficient escaping of a shortcode attribute in a JavaScript context before echoing into an inline script, enabling stored XSS via the Slider shortcode. Impact is that users with contrib...
CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...
CVE-2026-59521
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through = 3.1.15...
CVE-2026-59521
The CVE-2026-59521 issue affects the WordPress Real Testimonials plugin (testimonial-free) by Deserialization of Untrusted Data, enabling PHP object injection in versions
CVE-2026-59521 WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through = 3.1.15...
WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Real Testimonials versions = 3.1.15...
EUVD-2025-210361
Contributor Cross Site Scripting XSS in BNE Testimonials = 2.0.8 versions...
CVE-2025-68075
Contributor Cross Site Scripting XSS in BNE Testimonials = 2.0.8 versions...
CVE-2025-68075 WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in BNE Testimonials = 2.0.8 versions...
CVE-2025-68075
CVE-2025-68075 describes a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin BNE Testimonials (versions ≤ 2.0.8). The CVSS 3.1 base metrics are provided (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) with a base score of 6.5 (Medium). Connected sources confirm the affected produ...
WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin BNE Testimonials versions = 2.0.8...
PT-2026-52719
Name of the Vulnerable Software and Affected Versions BNE Testimonials versions prior to 2.0.9 Description Cross Site Scripting XSS exists in the software, allowing a user with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version...