PT-2022-22793 · WordPress · Testimonial Wordpress Plugin+1
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Testimonials WordPress plugin versions prior to 2.7
super-testimonial-pro WordPress plugin versions prior to 1.0.8
Description
The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the lack of sanitization and escaping of its settings.
Recommendations
For Testimonials WordPress plugin versions prior to 2.7, update to version 2.7 or later.
For super-testimonial-pro WordPress plugin versions prior to 1.0.8, update to version 1.0.8 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Testimonial Wordpress Plugin
Super-Testimonial-Pro Wordpress Plugin